public inbox for libstdc++-cvs@sourceware.org help / color / mirror / Atom feed
From: Jonathan Wakely <redi@gcc.gnu.org> To: gcc-cvs@gcc.gnu.org, libstdc++-cvs@gcc.gnu.org Subject: [gcc r12-7690] libstdc++: Rewrite __moneypunct_cache::_M_cache [PR104966] Date: Thu, 17 Mar 2022 17:52:00 +0000 (GMT) [thread overview] Message-ID: <20220317175200.5307C385380D@sourceware.org> (raw) https://gcc.gnu.org/g:38ce4489635f2d65de965af3ec5d5c4adf7762d9 commit r12-7690-g38ce4489635f2d65de965af3ec5d5c4adf7762d9 Author: Jonathan Wakely <jwakely@redhat.com> Date: Thu Mar 17 13:33:07 2022 +0000 libstdc++: Rewrite __moneypunct_cache::_M_cache [PR104966] GCC thinks the following can lead to a buffer overflow when __ns.size() equals zero: const basic_string<_CharT>& __ns = __mp.negative_sign(); _M_negative_sign_size = __ns.size(); __negative_sign = new _CharT[_M_negative_sign_size]; __ns.copy(__negative_sign, _M_negative_sign_size); This happens because operator new might be replaced with something that writes to this->_M_negative_sign_size and so the basic_string::copy call could use a non-zero size to write to a zero-length buffer. The solution suggested by Richi is to cache the size in a local variable so that the compiler knows it won't be changed between the allocation and the copy. This commit goes further and rewrites the whole function to use RAII and delay all modifications of *this until after all allocations have succeeded. The RAII helper type caches the size and copies the string and owns the memory until told to release it. libstdc++-v3/ChangeLog: PR middle-end/104966 * include/bits/locale_facets_nonio.tcc (__moneypunct_cache::_M_cache): Replace try-catch with RAII and make all string copies before any stores to *this. Diff: --- libstdc++-v3/include/bits/locale_facets_nonio.tcc | 102 +++++++++++----------- 1 file changed, 51 insertions(+), 51 deletions(-) diff --git a/libstdc++-v3/include/bits/locale_facets_nonio.tcc b/libstdc++-v3/include/bits/locale_facets_nonio.tcc index 98442418f51..8c37a706db8 100644 --- a/libstdc++-v3/include/bits/locale_facets_nonio.tcc +++ b/libstdc++-v3/include/bits/locale_facets_nonio.tcc @@ -71,61 +71,61 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION const moneypunct<_CharT, _Intl>& __mp = use_facet<moneypunct<_CharT, _Intl> >(__loc); + struct _Scoped_str + { + size_t _M_len; + _CharT* _M_str; + + explicit + _Scoped_str(const basic_string<_CharT>& __str) + : _M_len(__str.size()), _M_str(new _CharT[_M_len]) + { __str.copy(_M_str, _M_len); } + + ~_Scoped_str() { delete[] _M_str; } + + void + _M_release(const _CharT*& __p, size_t& __n) + { + __p = _M_str; + __n = _M_len; + _M_str = 0; + } + }; + + _Scoped_str __curr_symbol(__mp.curr_symbol()); + _Scoped_str __positive_sign(__mp.positive_sign()); + _Scoped_str __negative_sign(__mp.negative_sign()); + + const string& __g = __mp.grouping(); + const size_t __g_size = __g.size(); + char* const __grouping = new char[__g_size]; + __g.copy(__grouping, __g_size); + + // All allocations succeeded without throwing, OK to modify *this now. + + _M_grouping = __grouping; + _M_grouping_size = __g_size; + _M_use_grouping = (__g_size + && static_cast<signed char>(__grouping[0]) > 0 + && (__grouping[0] + != __gnu_cxx::__numeric_traits<char>::__max)); + _M_decimal_point = __mp.decimal_point(); _M_thousands_sep = __mp.thousands_sep(); + + __curr_symbol._M_release(_M_curr_symbol, _M_curr_symbol_size); + __positive_sign._M_release(_M_positive_sign, _M_positive_sign_size); + __negative_sign._M_release(_M_negative_sign, _M_negative_sign_size); + _M_frac_digits = __mp.frac_digits(); + _M_pos_format = __mp.pos_format(); + _M_neg_format = __mp.neg_format(); - char* __grouping = 0; - _CharT* __curr_symbol = 0; - _CharT* __positive_sign = 0; - _CharT* __negative_sign = 0; - __try - { - const string& __g = __mp.grouping(); - _M_grouping_size = __g.size(); - __grouping = new char[_M_grouping_size]; - __g.copy(__grouping, _M_grouping_size); - _M_use_grouping = (_M_grouping_size - && static_cast<signed char>(__grouping[0]) > 0 - && (__grouping[0] - != __gnu_cxx::__numeric_traits<char>::__max)); - - const basic_string<_CharT>& __cs = __mp.curr_symbol(); - _M_curr_symbol_size = __cs.size(); - __curr_symbol = new _CharT[_M_curr_symbol_size]; - __cs.copy(__curr_symbol, _M_curr_symbol_size); - - const basic_string<_CharT>& __ps = __mp.positive_sign(); - _M_positive_sign_size = __ps.size(); - __positive_sign = new _CharT[_M_positive_sign_size]; - __ps.copy(__positive_sign, _M_positive_sign_size); - - const basic_string<_CharT>& __ns = __mp.negative_sign(); - _M_negative_sign_size = __ns.size(); - __negative_sign = new _CharT[_M_negative_sign_size]; - __ns.copy(__negative_sign, _M_negative_sign_size); - - _M_pos_format = __mp.pos_format(); - _M_neg_format = __mp.neg_format(); - - const ctype<_CharT>& __ct = use_facet<ctype<_CharT> >(__loc); - __ct.widen(money_base::_S_atoms, - money_base::_S_atoms + money_base::_S_end, _M_atoms); - - _M_grouping = __grouping; - _M_curr_symbol = __curr_symbol; - _M_positive_sign = __positive_sign; - _M_negative_sign = __negative_sign; - _M_allocated = true; - } - __catch(...) - { - delete [] __grouping; - delete [] __curr_symbol; - delete [] __positive_sign; - delete [] __negative_sign; - __throw_exception_again; - } + const ctype<_CharT>& __ct = use_facet<ctype<_CharT> >(__loc); + __ct.widen(money_base::_S_atoms, + money_base::_S_atoms + money_base::_S_end, _M_atoms); + + _M_allocated = true; } _GLIBCXX_BEGIN_NAMESPACE_LDBL_OR_CXX11
reply other threads:[~2022-03-17 17:52 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220317175200.5307C385380D@sourceware.org \ --to=redi@gcc.gnu.org \ --cc=gcc-cvs@gcc.gnu.org \ --cc=libstdc++-cvs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).