public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/7075] New: sprintf(buf, "%sfoo", buf) has different results with -O2 -D_FORTIFY_SOURCE=2 (__sprintf_chk bug?)
@ 2008-12-07 17:43 kees at outflux dot net
  2008-12-07 17:44 ` [Bug libc/7075] " kees at outflux dot net
                   ` (8 more replies)
  0 siblings, 9 replies; 16+ messages in thread
From: kees at outflux dot net @ 2008-12-07 17:43 UTC (permalink / raw)
  To: glibc-bugs

Anders Kaseorg noticed that the use of _FORTIFY_SOURCE breaks a specific use of
sprintf (see attached):

$ gcc -O0 -o foo foo.c && ./foo
not fail
$ gcc -O2 -o foo foo.c && ./foo
not fail
$ gcc -O2 -D_FORTIFY_SOURCE=2 -o foo foo.c && ./foo
fail

The original report was filed in Ubuntu, where -D_FORTIFY_SOURCE=2 is enabled by
default: https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/305901

C99 states:
The sprintf function is equivalent to fprintf, except that the output is written
into an array (specified by the argument s) rather than to a stream. A null
character is written at the end of the characters written; it is not counted as
part of the returned value. If copying takes place between objects that overlap,
the behavior is undefined.

The man page does not mention this limitation, and prior to the use of
__sprintf_chk, this style of call worked as expected.  As such, a large volume
of source code uses this style of call:
http://web.mit.edu/andersk/Public/sprintf-results

It seems that it would make sense to fix __sprintf_chk, or very loudly mention
the C99-described overlap-is-undefined behavior in sprintf documentation.

-- 
           Summary: sprintf(buf, "%sfoo", buf) has different results with -
                    O2 -D_FORTIFY_SOURCE=2 (__sprintf_chk bug?)
           Product: glibc
           Version: 2.8
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: kees at outflux dot net
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=7075

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.


^ permalink raw reply	[flat|nested] 16+ messages in thread
end of thread, other threads:[~2014-06-16 10:57 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <bug-7075-131@http.sourceware.org/bugzilla/>
2014-02-16 17:44 ` [Bug libc/7075] sprintf(buf, "%sfoo", buf) has different results with -O2 -D_FORTIFY_SOURCE=2 (__sprintf_chk bug?) jackie.rosen at hushmail dot com
2014-05-28 19:42 ` schwab at sourceware dot org
2014-06-13 19:49 ` kees at outflux dot net
2014-06-13 20:25 ` schwab@linux-m68k.org
2014-06-13 20:36 ` kees at outflux dot net
2014-06-13 20:48 ` siddhesh at redhat dot com
2014-06-16 10:57 ` fweimer at redhat dot com
2008-12-07 17:43 [Bug libc/7075] New: " kees at outflux dot net
2008-12-07 17:44 ` [Bug libc/7075] " kees at outflux dot net
2008-12-07 17:52 ` schwab at suse dot de
2008-12-07 18:36 ` kees at outflux dot net
2008-12-07 19:08 ` schwab at suse dot de
2008-12-07 22:57 ` jakub at redhat dot com
2008-12-07 23:39 ` pasky at suse dot cz
2008-12-19 16:58 ` mtk dot manpages at gmail dot com
2008-12-24 17:41 ` kees at outflux dot net
2009-02-05  8:55 ` lidaobing at gmail dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).