From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2a07:de40:b251:101:10:150:64:1]) by sourceware.org (Postfix) with ESMTPS id AB59B4BA5436 for ; Wed, 1 Apr 2026 13:56:11 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org AB59B4BA5436 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=suse.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org AB59B4BA5436 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2a07:de40:b251:101:10:150:64:1 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1775051771; cv=none; b=Md5rMzrxKV7aizfmCWlNOS0Yvp8QKteLb49eY+npZAPtGwTW7/5CcgeCBAIS4m9Ky1KOceNrjG+yUbKz5Q4MqQGwZ5erTutXnA3vgDrIbbZ6U1YJm/iK1033lI1ndVMNzxP2Gju4ZOvatUCos7lmxQ49B8YWE0x7vItRjz+85zE= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1775051771; c=relaxed/simple; bh=TRH54ErjhPrWkxe/NzUTHo/0wgDXZisF7c1Y/xYFRzg=; h=DKIM-Signature:DKIM-Signature:DKIM-Signature:DKIM-Signature:From: To:Subject:Date:Message-ID:MIME-Version; b=ha+1tHHFHgzkkCT/EOMd0MFEfkaZiubECYzfi8JrRSNwmls4hZVXLCztN4N/57DUkXprDw2lKwe7McIJJ8zCjzwnStOo4dxJjG01o/HFx4ruoqTKXkOLd2UxUO8cppB1QpKmh/+UYKZkg1QGPaHYAROfiqlvsYLdKycIayeJ9HM= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org AB59B4BA5436 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=nfbKQcUc; dkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=+GEFBI0m; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=bC20+Gtp; dkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=gVqtQA3f Received: from hawking.suse.de (unknown [10.168.4.11]) by smtp-out1.suse.de (Postfix) with ESMTP id 9E2AA4D864; Wed, 1 Apr 2026 13:56:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1775051770; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GTfLzgnqxfOq100RWb8WVjAozJhVn/tXcM99v6xATYg=; b=nfbKQcUcHPjoZy2L858/BW2X1/rssyh4JuJycRQ+QGpvqNJp4yEhMWrGAGyG5lsItQX5Gk wNzDgQovRH8xZ0GDZz1rln9bgC/Kd3f2OYZKAsqcpv/qDNZG7W+VTVY9u2U6lhR0iSdSKo TwwobL0ik6mN9INKnkhX0D62hsTer0Y= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1775051770; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GTfLzgnqxfOq100RWb8WVjAozJhVn/tXcM99v6xATYg=; b=+GEFBI0mL/zVHBnx769pO9tS8IkJ0nbTWNfxK3Rud2utUx7XD3ovRRS/YrYYxXKuejp+t5 X28LshybLNQJXmCA== Authentication-Results: smtp-out1.suse.de; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1775051769; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GTfLzgnqxfOq100RWb8WVjAozJhVn/tXcM99v6xATYg=; b=bC20+GtpehEItJdEIIJr6GG+VD+xKM4hIzNt7o1SNFbL5BMGOhWIXwD3dDJvxrSUScWDeB tf33t+4yN11lVVxZgqsx4k7YkQWV23wes0A4tbrZhJpB+gOtuXattzUL8DqsYXVUWebnIA fxKW0j5X5gTrYIyoVmQ4PH8QEj8xVLE= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1775051769; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GTfLzgnqxfOq100RWb8WVjAozJhVn/tXcM99v6xATYg=; b=gVqtQA3fEU7XffU2qOQPdXbpjCExbAWM1ss5ZZjwc+XQJ72F5m2kBYwLj+YBzFoUwzWol7 0HFIPNGjodnwlEBQ== Received: by hawking.suse.de (Postfix, from userid 17005) id 5DFA54AAC2D; Wed, 1 Apr 2026 15:56:09 +0200 (CEST) From: Andreas Schwab To: Gao Xiang Cc: libc-alpha@sourceware.org Subject: Re: [PATCH v2] libio: Fix wide stream backup buffer leak on fclose [BZ #33999] In-Reply-To: <20260331133626.260355-1-gaoxiang@kylinos.cn> (Gao Xiang's message of "Tue, 31 Mar 2026 21:35:10 +0800") References: <20260331133626.260355-1-gaoxiang@kylinos.cn> Date: Wed, 01 Apr 2026 15:56:09 +0200 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Spamd-Result: default: False [-4.20 / 50.00]; BAYES_HAM(-3.00)[99.99%]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.20)[-0.995]; RCVD_NO_TLS_LAST(0.10)[]; MIME_GOOD(-0.10)[text/plain]; RCVD_COUNT_ONE(0.00)[1]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; MIME_TRACE(0.00)[0:+]; ARC_NA(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; FUZZY_RATELIMITED(0.00)[rspamd.com]; TO_MATCH_ENVRCPT_ALL(0.00)[]; DKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; DBL_BLOCKED_OPENRESOLVER(0.00)[suse.de:mid,suse.de:email] X-Spam-Score: -4.20 X-Spam-Level: X-Spam-Status: No, score=-9.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on sourceware.org List-Id: On Mär 31 2026, Gao Xiang wrote: > - Keeps wmemstream in the test: Agreed that ungetwc on a wmemstream is not > a valid application use.However I was unable to trigger the backup buffer > allocation through a tmpfile-based read/ungetwc sequence. Yes, all file-based stream types (initialized by _IO_new_file_init_internal which sets _IO_IS_FILEBUF) go through _IO_file_close_maybe_unlink which already deallocates the backup buffer, before the finish method is called. > Using wmemstream route is the most direct way to reach the leaking code in > _IO_wdefault_finish. Open to suggestions if you know a cleaner way to trigger it. It works because the memstream initializer does not set _IO_NO_READS, which could be considered a bug. Perhaps add a comment to the test that we are depending on this particular implementation quirk. > diff --git a/libio/tst-wbackup-leak.c b/libio/tst-wbackup-leak.c > new file mode 100644 > index 0000000000..c5bf128237 > --- /dev/null > +++ b/libio/tst-wbackup-leak.c > @@ -0,0 +1,45 @@ > +/* Test _IO_wdefault_finish frees wide backup buffer [BZ #33999]. */ > + > +#include > +#include > +#include > +#include > + > +static void > +one_round (void) > +{ > + wchar_t *buf = NULL; > + size_t size = 0; > + > + FILE *fp = open_wmemstream (&buf, &size); > + TEST_VERIFY_EXIT (fp != NULL); > + fputwc (L'A', fp); > + fflush (fp); > + /*·Push·back·without·prior·read.··read_ptr·==·read_base,·so > +···*··_IO_wdefault_pbackfail·skips·the·buggy·narrow·read_ptr·access > +···*··(BZ·#33998)·and·goes·straight·to·allocating·a·wide·backup > + ·*··buffer·at·fp->_wide_data->_IO_save_base.··*/ Please use regular spaces. -- Andreas Schwab, SUSE Labs, schwab@suse.de GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7 "And now for something completely different."