public inbox for libstdc++-cvs@sourceware.org help / color / mirror / Atom feed
From: Tobias Burnus <burnus@gcc.gnu.org> To: gcc-cvs@gcc.gnu.org, libstdc++-cvs@gcc.gnu.org Subject: [gcc/devel/omp/gcc-10] libstdc++: Fix std::to_chars buffer overflow (PR 95851) Date: Tue, 14 Jul 2020 10:49:54 +0000 (GMT) [thread overview] Message-ID: <20200714104954.3231E3858D37@sourceware.org> (raw) https://gcc.gnu.org/g:ff5c8fe44a98025c1e700cfc033247965e293869 commit ff5c8fe44a98025c1e700cfc033247965e293869 Author: Jonathan Wakely <jwakely@redhat.com> Date: Tue Jun 23 22:47:58 2020 +0100 libstdc++: Fix std::to_chars buffer overflow (PR 95851) The __detail::__to_chars_2 function assumes it won't be called with zero values. However, when the output buffer is empty the caller doesn't handle zero values correctly, and calls __to_chars_2 with a zero value, resulting in an overflow of the empty buffer. The __detail::__to_chars_i function should just return immediately for an empty buffer, and otherwise ensure zero values are handled properly. libstdc++-v3/ChangeLog: PR libstdc++/95851 * include/std/charconv (__to_chars_i): Check for zero-sized buffer unconditionally. * testsuite/20_util/to_chars/95851.cc: New test. (cherry picked from commit be50843754b4c4d47f0d628a84b3dbf2a4145a43) Diff: --- libstdc++-v3/include/std/charconv | 5 +++- libstdc++-v3/testsuite/20_util/to_chars/95851.cc | 36 ++++++++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/libstdc++-v3/include/std/charconv b/libstdc++-v3/include/std/charconv index 3caa0f8ac10..77a72d40dd0 100644 --- a/libstdc++-v3/include/std/charconv +++ b/libstdc++-v3/include/std/charconv @@ -327,7 +327,10 @@ namespace __detail using _Up = __detail::__unsigned_least_t<_Tp>; _Up __unsigned_val = __value; - if (__value == 0 && __first != __last) + if (__first == __last) [[__unlikely__]] + return { __last, errc::value_too_large }; + + if (__value == 0) { *__first = '0'; return { __first + 1, errc{} }; diff --git a/libstdc++-v3/testsuite/20_util/to_chars/95851.cc b/libstdc++-v3/testsuite/20_util/to_chars/95851.cc new file mode 100644 index 00000000000..5f0daf3b30b --- /dev/null +++ b/libstdc++-v3/testsuite/20_util/to_chars/95851.cc @@ -0,0 +1,36 @@ +// Copyright (C) 2020 Free Software Foundation, Inc. +// +// This file is part of the GNU ISO C++ Library. This library is free +// software; you can redistribute it and/or modify it under the +// terms of the GNU General Public License as published by the +// Free Software Foundation; either version 3, or (at your option) +// any later version. + +// This library is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. + +// You should have received a copy of the GNU General Public License along +// with this library; see the file COPYING3. If not see +// <http://www.gnu.org/licenses/>. + +// { dg-do run { target c++14 } } + +#include <charconv> +#include <testsuite_hooks.h> + +void +test01() +{ + char* p = nullptr; + auto res = std::to_chars(p, p, 0, 2); // PR libstdc++/95851 + VERIFY( res.ptr == p ); + VERIFY( res.ec == std::errc::value_too_large ); +} + +int +main() +{ + test01(); +}
reply other threads:[~2020-07-14 10:49 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200714104954.3231E3858D37@sourceware.org \ --to=burnus@gcc.gnu.org \ --cc=gcc-cvs@gcc.gnu.org \ --cc=libstdc++-cvs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).