From: Joe Simmons-Talbott <josimmon@redhat.com>
To: libc-alpha@sourceware.org
Cc: Joe Simmons-Talbott <josimmon@redhat.com>
Subject: [PATCH] vfscanf-internal: Get rid of unbounded allocas
Date: Tue, 27 Jun 2023 14:05:56 -0400 [thread overview]
Message-ID: <20230627180556.728512-1-josimmon@redhat.com> (raw)
Replace two unbounded allocas with scratch_buffers to avoid potential
stack overflow.
---
stdio-common/vfscanf-internal.c | 26 +++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
index bfb9baa21a..60376ccff9 100644
--- a/stdio-common/vfscanf-internal.c
+++ b/stdio-common/vfscanf-internal.c
@@ -335,6 +335,12 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
struct char_buffer charbuf;
scratch_buffer_init (&charbuf.scratch);
+ struct scratch_buffer wc_ext_sbuf;
+ scratch_buffer_init (&wc_ext_sbuf);
+
+ struct scratch_buffer mb_ext_sbuf;
+ scratch_buffer_init (&mb_ext_sbuf);
+
#ifdef __va_copy
__va_copy (arg, argptr);
#else
@@ -1488,8 +1494,14 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
wcdigits[n] = (const wchar_t *)
_NL_CURRENT (LC_CTYPE, _NL_CTYPE_INDIGITS0_WC + n);
- wchar_t *wc_extended = (wchar_t *)
- alloca ((to_level + 2) * sizeof (wchar_t));
+ wchar_t *wc_extended;
+ if (!scratch_buffer_set_array_size
+ (&wc_ext_sbuf, sizeof (wchar_t), to_level + 2))
+ {
+ done = EOF;
+ goto errout;
+ }
+ wc_extended = wc_ext_sbuf.data;
__wmemcpy (wc_extended, wcdigits[n], to_level);
wc_extended[to_level] = __towctrans (L'0' + n, map);
wc_extended[to_level + 1] = '\0';
@@ -1525,7 +1537,13 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
/* Allocate memory for extended multibyte digit. */
char *mb_extended;
- mb_extended = (char *) alloca (mbdigits_len + mblen + 1);
+ if (!scratch_buffer_set_array_size
+ (&mb_ext_sbuf, 1, mbdigits_len + mblen + 1))
+ {
+ done = EOF;
+ goto errout;
+ }
+ mb_extended = mb_ext_sbuf.data;
/* And get the mbdigits + extra_digit string. */
*(char *) __mempcpy (__mempcpy (mb_extended, mbdigits[n],
@@ -3063,5 +3081,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
free (*strptr);
*strptr = NULL;
}
+ scratch_buffer_free (&wc_ext_sbuf);
+ scratch_buffer_free (&mb_ext_sbuf);
return done;
}
--
2.39.2
next reply other threads:[~2023-06-27 18:06 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-27 18:05 Joe Simmons-Talbott [this message]
2023-06-30 18:14 ` Adhemerval Zanella Netto
2023-07-03 13:40 ` Adhemerval Zanella Netto
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230627180556.728512-1-josimmon@redhat.com \
--to=josimmon@redhat.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).