[PATCH] Fix mbtowc with large n values

[PATCH] Fix mbtowc with large n values

[Jakub Jelinek]

Hi!

If n is too large and s + n wraps in the address space, mbtowc would fail,
yet the standard apparently doesn't require all of [s; s + n) to be valid
memory.

2004-02-23  Jakub Jelinek  <jakub@redhat.com>

	* wcsmbs/mbrtowc.c (__mbrtowc): Cap s + n at the end of address space.
	* stdlib/Makefile (tests): Add testmb2.
	(testmb2-ENV): New.
	* stdlib/testmb2.c: New test.

--- libc/wcsmbs/mbrtowc.c.jj	2002-09-02 21:34:23.000000000 +0200
+++ libc/wcsmbs/mbrtowc.c	2004-02-23 23:34:24.624698543 +0100
@@ -1,4 +1,5 @@
-/* Copyright (C) 1996,1997,1998,1999,2000,2002 Free Software Foundation, Inc.
+/* Copyright (C) 1996, 1997, 1998, 1999, 2000, 2002, 2004
+   Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@gnu.org>, 1996.
 
@@ -40,7 +41,7 @@ __mbrtowc (wchar_t *pwc, const char *s, 
   int status;
   size_t result;
   size_t dummy;
-  const unsigned char *inbuf;
+  const unsigned char *inbuf, *endbuf;
   char *outbuf = (char *) (pwc ?: buf);
   const struct gconv_fcts *fcts;
 
@@ -69,8 +70,11 @@ __mbrtowc (wchar_t *pwc, const char *s, 
 
   /* Do a normal conversion.  */
   inbuf = (const unsigned char *) s;
+  endbuf = inbuf + n;
+  if (endbuf < inbuf)
+    endbuf = (const unsigned char *) ~(uintptr_t) 0;
   status = DL_CALL_FCT (fcts->towc->__fct,
-			(fcts->towc, &data, &inbuf, inbuf + n,
+			(fcts->towc, &data, &inbuf, endbuf,
 			 NULL, &dummy, 0, 1));
 
   /* There must not be any problems with the conversion but illegal input
--- libc/stdlib/Makefile.jj	2003-09-22 17:35:41.000000000 +0200
+++ libc/stdlib/Makefile	2004-02-23 23:57:07.509887232 +0100
@@ -1,4 +1,4 @@
-# Copyright (C) 1991-2002, 2003 Free Software Foundation, Inc.
+# Copyright (C) 1991-2002, 2003, 2004 Free Software Foundation, Inc.
 # This file is part of the GNU C Library.
 
 # The GNU C Library is free software; you can redistribute it and/or
@@ -63,7 +63,7 @@ tests		:= tst-strtol tst-strtod testmb t
 		   test-canon test-canon2 tst-strtoll tst-environ	    \
 		   tst-xpg-basename tst-random tst-bsearch tst-limits	    \
 		   tst-rand48 bug-strtod tst-setcontext test-a64l tst-qsort \
-		   tst-system
+		   tst-system testmb2
 
 
 # Several mpn functions from GNU MP are used by the strtod function.
@@ -105,6 +105,7 @@ include ../Rules
 test-canon-ARGS = --test-dir=${common-objpfx}stdlib
 
 tst-strtod-ENV = LOCPATH=$(common-objpfx)localedata
+testmb2-ENV = LOCPATH=$(common-objpfx)localedata
 
 # Run a test on the header files we use.
 tests: $(objpfx)isomac.out
--- libc/stdlib/testmb2.c.jj	2004-02-23 23:54:59.972706399 +0100
+++ libc/stdlib/testmb2.c	2004-02-24 00:01:09.079661216 +0100
@@ -0,0 +1,31 @@
+/* Test case by Miloslav Trmac <mitr@volny.cz>.  */
+#include <locale.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+int
+main (void)
+{
+  wchar_t wc;
+
+  if (setlocale (LC_CTYPE, "de_DE.UTF-8") == NULL)
+    {
+      puts ("setlocale failed");
+      return 1;
+    }
+
+  if (mbtowc (&wc, "\xc3\xa1", MB_CUR_MAX) != 2 || wc != 0xE1)
+    {
+      puts ("1st mbtowc failed");
+      return 1;
+    }
+
+  if (mbtowc (&wc, "\xc3\xa1", SIZE_MAX) != 2 || wc != 0xE1)
+    {
+      puts ("2nd mbtowc failed");
+      return 1;
+    }
+
+  return 0;
+}

	Jakub

Re: [PATCH] Fix mbtowc with large n values

[Ulrich Drepper]

Applied.

-- 
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖