From: Florian Weimer <fw@deneb.enyo.de>
To: Alyssa Ross <hi@alyssa.is>
Cc: libc-alpha@sourceware.org
Subject: Re: [PATCH] stdio: fix vfscanf with matches longer than INT_MAX (bug 27650)
Date: Thu, 25 Mar 2021 18:25:17 +0100 [thread overview]
Message-ID: <878s6bkuwy.fsf@mid.deneb.enyo.de> (raw)
In-Reply-To: <20210325140102.31043-1-hi@alyssa.is> (Alyssa Ross's message of "Thu, 25 Mar 2021 14:01:02 +0000")
* Alyssa Ross:
> I have not done a copyright assignment yet, but I think this change
> should be small enough to be exempt?
Yes, I think it's small enough.
The test case wouldn't be, though. I think the one on the bug needs
some large (infinite) input on the stdin, though. A real test case
for glibc should probably involve pipe, fork, and fdopen. fopencookie
could work, too.
> stdio-common/vfscanf-internal.c | 13 ++++---------
> 1 file changed, 4 insertions(+), 9 deletions(-)
>
> diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
> index 38e74776a5..1d81e16f4e 100644
> --- a/stdio-common/vfscanf-internal.c
> +++ b/stdio-common/vfscanf-internal.c
> @@ -2479,11 +2479,6 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
> else
> not_in = 0;
>
> - if (width < 0)
> - /* There is no width given so there is also no limit on the
> - number of characters we read. Therefore we set width to
> - a very high value to make the algorithm easier. */
> - width = INT_MAX;
>
> #ifdef COMPILE_WSCANF
> /* Find the beginning and the end of the scanlist. We are not
> @@ -2647,7 +2642,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
> }
> }
> }
> - while (--width > 0 && inchar () != WEOF);
> + while ((width < 0 || --width > 0) && inchar () != WEOF);
> out:
> #else
> char buf[MB_LEN_MAX];
> @@ -2732,7 +2727,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
> }
> }
>
> - if (--width <= 0)
> + if (width >= 0 && --width <= 0)
> break;
> }
> while (inchar () != EOF);
> @@ -2884,7 +2879,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
> assert (n <= MB_LEN_MAX);
> str += n;
> }
> - while (--width > 0 && inchar () != WEOF);
> + while ((width < 0 || --width > 0) && inchar () != WEOF);
> out2:
> #else
> do
> @@ -2938,7 +2933,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
> }
> }
> }
> - while (--width > 0 && inchar () != EOF);
> + while ((width < 0 || --width > 0) && inchar () != EOF);
> #endif
>
> if (__glibc_unlikely (now == read_in))
So I tried to review this. -U100 helped. I was worried about width
starting out as positive and going negative. But as far as I can
tell, processing stops once width == 0, so the issue cannot happen.
Do you want to work on the test case? Will the copyright assignment
be an obstacle?
next prev parent reply other threads:[~2021-03-25 17:25 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-25 14:01 Alyssa Ross
2021-03-25 17:25 ` Florian Weimer [this message]
2021-03-25 20:28 ` Alyssa Ross
2021-03-25 21:24 ` Florian Weimer
2021-03-26 12:00 ` Alyssa Ross
2021-03-26 12:17 ` Florian Weimer
2021-03-29 12:01 ` Alyssa Ross
2021-03-29 13:34 ` Florian Weimer
2021-03-29 18:06 ` [PATCH 2/2] stdio: add test for scanf " Alyssa Ross
2021-05-09 21:56 ` Alyssa Ross
2021-05-03 8:57 ` [PATCH] stdio: fix vfscanf with " Florian Weimer
2021-05-09 16:32 ` Alyssa Ross
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878s6bkuwy.fsf@mid.deneb.enyo.de \
--to=fw@deneb.enyo.de \
--cc=hi@alyssa.is \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).