[gcc r11-9900] libstdc++: Fix warning in __moneypunct_cache::_M_cache [PR104966]

[gcc r11-9900] libstdc++: Fix warning in __moneypunct_cache::_M_cache [PR104966]

[Jonathan Wakely]

https://gcc.gnu.org/g:3859a3cb9b997fb8d9134180b8cc68f040dd36f5

commit r11-9900-g3859a3cb9b997fb8d9134180b8cc68f040dd36f5
Author: Jonathan Wakely <jwakely@redhat.com>
Date:   Thu Mar 17 13:33:07 2022 +0000

    libstdc++: Fix warning in __moneypunct_cache::_M_cache [PR104966]
    
    GCC thinks the following can lead to a buffer overflow when __ns.size()
    equals zero:
    
              const basic_string<_CharT>& __ns = __mp.negative_sign();
              _M_negative_sign_size = __ns.size();
              __negative_sign = new _CharT[_M_negative_sign_size];
              __ns.copy(__negative_sign, _M_negative_sign_size);
    
    This happens because operator new might be replaced with something that
    writes to this->_M_negative_sign_size and so the basic_string::copy call
    could use a non-zero size to write to a zero-length buffer.
    
    The solution suggested by Richi is to cache the size in a local variable
    so that the compiler knows it won't be changed between the allocation
    and the copy.
    
    libstdc++-v3/ChangeLog:
    
            PR middle-end/104966
            * include/bits/locale_facets_nonio.tcc
            (__moneypunct_cache::_M_cache): Store string sizes in local
            variable that doesn't escape.

Diff:
---
 libstdc++-v3/include/bits/locale_facets_nonio.tcc | 27 ++++++++++++-----------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/libstdc++-v3/include/bits/locale_facets_nonio.tcc b/libstdc++-v3/include/bits/locale_facets_nonio.tcc
index 51c23d8003a..4aef5502032 100644
--- a/libstdc++-v3/include/bits/locale_facets_nonio.tcc
+++ b/libstdc++-v3/include/bits/locale_facets_nonio.tcc
@@ -78,32 +78,33 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
       char* __grouping = 0;
       _CharT* __curr_symbol = 0;
       _CharT* __positive_sign = 0;
-      _CharT* __negative_sign = 0;     
+      _CharT* __negative_sign = 0;
+      size_t __sz;
       __try
 	{
 	  const string& __g = __mp.grouping();
-	  _M_grouping_size = __g.size();
-	  __grouping = new char[_M_grouping_size];
-	  __g.copy(__grouping, _M_grouping_size);
+	  __sz = _M_grouping_size = __g.size();
+	  __grouping = new char[__sz];
+	  __g.copy(__grouping, __sz);
 	  _M_use_grouping = (_M_grouping_size
 			     && static_cast<signed char>(__grouping[0]) > 0
 			     && (__grouping[0]
 				 != __gnu_cxx::__numeric_traits<char>::__max));
 
 	  const basic_string<_CharT>& __cs = __mp.curr_symbol();
-	  _M_curr_symbol_size = __cs.size();
-	  __curr_symbol = new _CharT[_M_curr_symbol_size];
-	  __cs.copy(__curr_symbol, _M_curr_symbol_size);
+	  __sz = _M_curr_symbol_size = __cs.size();
+	  __curr_symbol = new _CharT[__sz];
+	  __cs.copy(__curr_symbol, __sz);
 
 	  const basic_string<_CharT>& __ps = __mp.positive_sign();
-	  _M_positive_sign_size = __ps.size();
-	  __positive_sign = new _CharT[_M_positive_sign_size];
-	  __ps.copy(__positive_sign, _M_positive_sign_size);
+	  __sz = _M_positive_sign_size = __ps.size();
+	  __positive_sign = new _CharT[__sz];
+	  __ps.copy(__positive_sign, __sz);
 
 	  const basic_string<_CharT>& __ns = __mp.negative_sign();
-	  _M_negative_sign_size = __ns.size();
-	  __negative_sign = new _CharT[_M_negative_sign_size];
-	  __ns.copy(__negative_sign, _M_negative_sign_size);
+	  __sz = _M_negative_sign_size = __ns.size();
+	  __negative_sign = new _CharT[__sz];
+	  __ns.copy(__negative_sign, __sz);
 
 	  _M_pos_format = __mp.pos_format();
 	  _M_neg_format = __mp.neg_format();