Re: [PATCH] Account for grouping in printf width (bug 23432)

[Vincent Lefevre <vincent@vinc17.net>]

On 2023-01-22 18:20:52 -0500, Carlos O'Donell wrote:
> On 1/21/23 06:40, Florian Weimer wrote:
> > * Andreas Schwab via Libc-alpha:
> > 
> >> diff --git a/stdio-common/Makefile b/stdio-common/Makefile
> >> index 6e9d104524..b46d932a20 100644
> >> --- a/stdio-common/Makefile
> >> +++ b/stdio-common/Makefile
> >> @@ -195,6 +195,7 @@ tests := \
> >>    tst-gets \
> >>    tst-grouping \
> >>    tst-grouping2 \
> >> +  tst-grouping3 \
> >>    tst-long-dbl-fphex \
> >>    tst-memstream-string \
> >>    tst-obprintf \
> > 
> > Missing $(gen-locales) dependency.  The change itself seems okay, it
> > seems to align with POSIX.  Not sure if this is still possibly to
> > apply during the freeze.
> 
> I'd like to avoid a partial fix like this just before we release 2.27.

2.37

> My preference would be to review this more thoroughly, apply it when
> 2.28 opens, and then backport when we have confidence the issue is
  ^^^^ 2.38
> resolved.

There's actually another bug, which is a regression in glibc 2.37
and a security issue (possible buffer overflow resulting from this
new bug, as additional characters are output):

  https://sourceware.org/bugzilla/show_bug.cgi?id=30068

and according to

  https://sourceware.org/bugzilla/show_bug.cgi?id=30068#c5

this patch fixes this new bug.

(In bug 23432, I was considering only the precision field, while
in bug 30068, this is the width field, though these issues may be
related in the implementation.)

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)