[Bug stdio/30039] New: __vsprintf_internal does not handle unespecified buffer length in fortify mode

["fweimer at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=30039

            Bug ID: 30039
           Summary: __vsprintf_internal does not handle unespecified
                    buffer length in fortify mode
           Product: glibc
           Version: 2.37
            Status: NEW
          Severity: normal
          Priority: P1
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---

From libio/iovsprintf.c:

  /* When called from fortified sprintf/vsprintf, erase the destination
     buffer and try to detect overflows.  When called from regular
     sprintf/vsprintf, do not erase the destination buffer, because
     known user code relies on this behavior (even though its undefined
     by ISO C), nor try to detect overflows.  */
  if ((mode_flags & PRINTF_CHK) != 0)
    {
      string[0] = '\0';
      __printf_buffer_init (&buf, string, maxlen,
                            __printf_buffer_mode_sprintf_chk);
    }
  else
    {
      __printf_buffer_init (&buf, string, 0, __printf_buffer_mode_sprintf);
      buf.write_end = (char *) ~(uintptr_t) 0; /* End of address space.  */
    }

However, in some cases, this code is called for an inline expansion of sprintf
where the buffer size is not known and maxlen == -1. This makes buf->write_end
== buf->write_ptr - 1 (so end before active write position). This causes an
assertion failure in __printf_buffer_as_file_commit:

Fatal glibc error: printf_buffer_as_file.c:31 (__printf_buffer_as_file_commit):
assertion failed: file->stream._IO_write_ptr <= file->next->write_end

I believe the assertion is not unreasonable, so I think we need to fix the
buffer setup.

-- 
You are receiving this mail because:
You are on the CC list for the bug.