Re: [PATCH 1/4] locale: Use correct buffer size for utf8_sequence_error [BZ #19444]

[Carlos O'Donell <carlos@redhat.com>]

On 12/29/22 07:57, Adhemerval Zanella via Libc-alpha wrote:
> The buffer used by snprintf might not be large enough for all possible
> inputs, as indicated by gcc with -O1:
> 
> ../locale/programs/linereader.c: In function ‘utf8_sequence_error’:
> ../locale/programs/linereader.c:713:58: error: ‘%02x’ directive output
> may be truncated writing between 2 and 8 bytes into a region of size
> between 1 and 13 [-Werror=format-truncation=]
>   713 |     snprintf (buf, sizeof (buf), "0x%02x 0x%02x 0x%02x 0x%02x",
>       |                                                          ^~~~
> ../locale/programs/linereader.c:713:34: note: directive argument in the
> range [0, 2147483647]
>   713 |     snprintf (buf, sizeof (buf), "0x%02x 0x%02x 0x%02x 0x%02x",
>       |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ../locale/programs/linereader.c:713:5: note: ‘snprintf’ output between
> 20 and 38 bytes into a destination of size 30
>   713 |     snprintf (buf, sizeof (buf), "0x%02x 0x%02x 0x%02x 0x%02x",
>       |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>   714 |               ch1, ch2, ch3, ch4);
>       |               ~~~~~~~~~~~~~~~~~~~
> 
> Checked on x86_64-linux-gnu.

LGTM. Took me a minute to work out the 38 bytes value though.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>

> ---
>  locale/programs/linereader.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/locale/programs/linereader.c b/locale/programs/linereader.c
> index 0460074a0c..794f25a6e4 100644
> --- a/locale/programs/linereader.c
> +++ b/locale/programs/linereader.c
> @@ -701,7 +701,7 @@ static bool
>  utf8_sequence_error (struct linereader *lr, uint8_t ch1, int ch2, int ch3,
>  		     int ch4)
>  {
> -  char buf[30];
> +  char buf[38];

OK.

"0x7f 0x7fffffff 0x7fffffff 0x7fffffff\0" 
= 4 + 1 + 10 + 1 + 10 + 1 + 10 + 1 = 38 bytes including null terminator.

I expect that at -O2 that VRP can see the values propagated from utf8_decode
and determine the buffer will be smaller by a lot given the range checks.

The ch2, ch3, and ch4 values shall not exceed 0xff in all cases since they
are all distinct bytes in the UTF-8 sequence. I expect that the worst case
is actually "0xff 0xff 0xff 0xff\0" or 20 bytes, but if the checks in
utf8_decode are changed then the worst case could be 38 bytes.

>  
>    if (ch2 < 0)
>      snprintf (buf, sizeof (buf), "0x%02x", ch1);

-- 
Cheers,
Carlos.