From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2a07:de40:b251:101:10:150:64:1]) by sourceware.org (Postfix) with ESMTPS id A2D6E4BA2E15 for ; Thu, 2 Apr 2026 12:47:42 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A2D6E4BA2E15 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=suse.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org A2D6E4BA2E15 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2a07:de40:b251:101:10:150:64:1 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1775134062; cv=none; b=I8eIAO5jkx2gykwLqXMkzr1cAqNQRr7bnr8oDhuhftF6uCr/RrCvuUrUKYOHib/4Ped6V2bhxFZBxfoXZqMQlDzjLFIrF4RehvjnGCHRIKUfAScG8rqgNxrlm3hs94bxOaj0elUfm14zr8fpXov3kHqgB5CM+aTCYTL4Ax5wzks= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1775134062; c=relaxed/simple; bh=pWmwbbLGZdHin7ciG7j2b40ffScqjLbStGC5aR08gBg=; h=DKIM-Signature:DKIM-Signature:DKIM-Signature:DKIM-Signature:From: To:Subject:Date:Message-ID:MIME-Version; b=sSTnnF9+70v9PqACdso50hOdgMUWqoCHnln/ZXwlgmuVgWzePtPLVqYRhQXphnarVyst6KlwBio9YX9PyYeY+j7DDEAlgMYv4WtLfuDJk9IWVAuHcbzfPScEpJ5jIV1Zup8kFloW5pmPGjiX/83j/y5qqnqNoN4t12P3fbTKiXs= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A2D6E4BA2E15 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=imo1BpKw; dkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=yFZcuL5M; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=imo1BpKw; dkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=yFZcuL5M Received: from hawking.suse.de (unknown [10.168.4.11]) by smtp-out1.suse.de (Postfix) with ESMTP id A99CF4D342; Thu, 2 Apr 2026 12:47:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1775134061; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=c5Ds3w8s9vf2g7ohLsbpwG+g03aJiQ2CQyvvBda17BU=; b=imo1BpKwA2NblV4dBwNoDorIHAPz2Frx6DZmZ8prK4rLjzUPr0L1a5RygIpQT3lC7Zk2x1 qC12NwT+ZshYo2smrWFRLH5oATJfvqhKlgB25Fyv6Dq8bGpNzsR9kSILXfUrRsZbmFJor+ VGujClCgyMOCrX1OgQjZrTuDx1c2ets= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1775134061; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=c5Ds3w8s9vf2g7ohLsbpwG+g03aJiQ2CQyvvBda17BU=; b=yFZcuL5MWSu4apIaF5lX+m66FdAKtqO1r4NiItuyIG892xFRVOp96XuYhU+DyI0VETswnF 7mNK2cTQPnIZwzDQ== Authentication-Results: smtp-out1.suse.de; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1775134061; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=c5Ds3w8s9vf2g7ohLsbpwG+g03aJiQ2CQyvvBda17BU=; b=imo1BpKwA2NblV4dBwNoDorIHAPz2Frx6DZmZ8prK4rLjzUPr0L1a5RygIpQT3lC7Zk2x1 qC12NwT+ZshYo2smrWFRLH5oATJfvqhKlgB25Fyv6Dq8bGpNzsR9kSILXfUrRsZbmFJor+ VGujClCgyMOCrX1OgQjZrTuDx1c2ets= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1775134061; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=c5Ds3w8s9vf2g7ohLsbpwG+g03aJiQ2CQyvvBda17BU=; b=yFZcuL5MWSu4apIaF5lX+m66FdAKtqO1r4NiItuyIG892xFRVOp96XuYhU+DyI0VETswnF 7mNK2cTQPnIZwzDQ== Received: by hawking.suse.de (Postfix, from userid 17005) id 9A3DD4AAC33; Thu, 2 Apr 2026 14:47:41 +0200 (CEST) From: Andreas Schwab To: Gao Xiang Cc: libc-alpha@sourceware.org Subject: Re: [PATCH v3] libio: Fix wide stream backup buffer leak on fclose [BZ #33999] In-Reply-To: <20260402062544.322321-1-gaoxiang@kylinos.cn> (Gao Xiang's message of "Thu, 2 Apr 2026 14:25:44 +0800") References: <20260402062544.322321-1-gaoxiang@kylinos.cn> Date: Thu, 02 Apr 2026 14:47:41 +0200 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain X-Spamd-Result: default: False [-4.20 / 50.00]; BAYES_HAM(-3.00)[100.00%]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.20)[-0.995]; RCVD_NO_TLS_LAST(0.10)[]; MIME_GOOD(-0.10)[text/plain]; RCVD_COUNT_ONE(0.00)[1]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; MIME_TRACE(0.00)[0:+]; ARC_NA(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; FUZZY_RATELIMITED(0.00)[rspamd.com]; TO_MATCH_ENVRCPT_ALL(0.00)[]; DKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; DBL_BLOCKED_OPENRESOLVER(0.00)[suse.de:mid,suse.de:email] X-Spam-Score: -4.20 X-Spam-Level: X-Spam-Status: No, score=-9.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org List-Id: On Apr 02 2026, Gao Xiang wrote: > diff --git a/libio/tst-wbackup-leak.c b/libio/tst-wbackup-leak.c > new file mode 100644 > index 0000000000..8a3e0fc1ed > --- /dev/null > +++ b/libio/tst-wbackup-leak.c > @@ -0,0 +1,50 @@ > +/* Test _IO_wdefault_finish frees wide backup buffer [BZ #33999]. */ > + > +#include > +#include > +#include > +#include > + > +static void > +one_round (void) > +{ > + wchar_t *buf = NULL; > + size_t size = 0; > + > + FILE *fp = open_wmemstream (&buf, &size); > + TEST_VERIFY_EXIT (fp != NULL); > + fputwc (L'A', fp); > + fflush (fp); > + /* Push back without prior read. read_ptr == read_base, so > + _IO_wdefault_pbackfail skips the buggy narrow read_ptr access > + (BZ #33998) and goes straight to allocating a wide backup > + buffer at fp->_wide_data->_IO_save_base. > + > + Note: this testcase relies on the fact that open_wmemstream > + does not set _IO_NO_READS on the stream. If that implementation > + is changed, this test would need a different stream type to verify > + the leak. */ > + ungetwc (L'Z', fp); When switching from output to input mode a seek is required, so prepending a rewind (fp) here would be needed. Ok with that change. -- Andreas Schwab, SUSE Labs, schwab@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different."