public inbox for libstdc++-cvs@sourceware.org help / color / mirror / Atom feed
From: Jonathan Wakely <redi@gcc.gnu.org> To: gcc-cvs@gcc.gnu.org, libstdc++-cvs@gcc.gnu.org Subject: [gcc r11-9900] libstdc++: Fix warning in __moneypunct_cache::_M_cache [PR104966] Date: Thu, 21 Apr 2022 12:32:27 +0000 (GMT) [thread overview] Message-ID: <20220421123227.922F63888C4F@sourceware.org> (raw) https://gcc.gnu.org/g:3859a3cb9b997fb8d9134180b8cc68f040dd36f5 commit r11-9900-g3859a3cb9b997fb8d9134180b8cc68f040dd36f5 Author: Jonathan Wakely <jwakely@redhat.com> Date: Thu Mar 17 13:33:07 2022 +0000 libstdc++: Fix warning in __moneypunct_cache::_M_cache [PR104966] GCC thinks the following can lead to a buffer overflow when __ns.size() equals zero: const basic_string<_CharT>& __ns = __mp.negative_sign(); _M_negative_sign_size = __ns.size(); __negative_sign = new _CharT[_M_negative_sign_size]; __ns.copy(__negative_sign, _M_negative_sign_size); This happens because operator new might be replaced with something that writes to this->_M_negative_sign_size and so the basic_string::copy call could use a non-zero size to write to a zero-length buffer. The solution suggested by Richi is to cache the size in a local variable so that the compiler knows it won't be changed between the allocation and the copy. libstdc++-v3/ChangeLog: PR middle-end/104966 * include/bits/locale_facets_nonio.tcc (__moneypunct_cache::_M_cache): Store string sizes in local variable that doesn't escape. Diff: --- libstdc++-v3/include/bits/locale_facets_nonio.tcc | 27 ++++++++++++----------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/libstdc++-v3/include/bits/locale_facets_nonio.tcc b/libstdc++-v3/include/bits/locale_facets_nonio.tcc index 51c23d8003a..4aef5502032 100644 --- a/libstdc++-v3/include/bits/locale_facets_nonio.tcc +++ b/libstdc++-v3/include/bits/locale_facets_nonio.tcc @@ -78,32 +78,33 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION char* __grouping = 0; _CharT* __curr_symbol = 0; _CharT* __positive_sign = 0; - _CharT* __negative_sign = 0; + _CharT* __negative_sign = 0; + size_t __sz; __try { const string& __g = __mp.grouping(); - _M_grouping_size = __g.size(); - __grouping = new char[_M_grouping_size]; - __g.copy(__grouping, _M_grouping_size); + __sz = _M_grouping_size = __g.size(); + __grouping = new char[__sz]; + __g.copy(__grouping, __sz); _M_use_grouping = (_M_grouping_size && static_cast<signed char>(__grouping[0]) > 0 && (__grouping[0] != __gnu_cxx::__numeric_traits<char>::__max)); const basic_string<_CharT>& __cs = __mp.curr_symbol(); - _M_curr_symbol_size = __cs.size(); - __curr_symbol = new _CharT[_M_curr_symbol_size]; - __cs.copy(__curr_symbol, _M_curr_symbol_size); + __sz = _M_curr_symbol_size = __cs.size(); + __curr_symbol = new _CharT[__sz]; + __cs.copy(__curr_symbol, __sz); const basic_string<_CharT>& __ps = __mp.positive_sign(); - _M_positive_sign_size = __ps.size(); - __positive_sign = new _CharT[_M_positive_sign_size]; - __ps.copy(__positive_sign, _M_positive_sign_size); + __sz = _M_positive_sign_size = __ps.size(); + __positive_sign = new _CharT[__sz]; + __ps.copy(__positive_sign, __sz); const basic_string<_CharT>& __ns = __mp.negative_sign(); - _M_negative_sign_size = __ns.size(); - __negative_sign = new _CharT[_M_negative_sign_size]; - __ns.copy(__negative_sign, _M_negative_sign_size); + __sz = _M_negative_sign_size = __ns.size(); + __negative_sign = new _CharT[__sz]; + __ns.copy(__negative_sign, __sz); _M_pos_format = __mp.pos_format(); _M_neg_format = __mp.neg_format();
reply other threads:[~2022-04-21 12:32 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220421123227.922F63888C4F@sourceware.org \ --to=redi@gcc.gnu.org \ --cc=gcc-cvs@gcc.gnu.org \ --cc=libstdc++-cvs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).