From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id C98CC385DC08 for ; Thu, 17 Mar 2022 17:52:33 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org C98CC385DC08 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-353-AmOKtD69MDmcAGiNdOwbZA-1; Thu, 17 Mar 2022 13:52:30 -0400 X-MC-Unique: AmOKtD69MDmcAGiNdOwbZA-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 1284285A5A8; Thu, 17 Mar 2022 17:52:30 +0000 (UTC) Received: from localhost (unknown [10.33.36.3]) by smtp.corp.redhat.com (Postfix) with ESMTP id CD19E46A0F1; Thu, 17 Mar 2022 17:52:29 +0000 (UTC) From: Jonathan Wakely To: libstdc++@gcc.gnu.org, gcc-patches@gcc.gnu.org Subject: [committed] libstdc++: Rewrite __moneypunct_cache::_M_cache [PR104966] Date: Thu, 17 Mar 2022 17:52:29 +0000 Message-Id: <20220317175229.406025-1-jwakely@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.85 on 10.11.54.9 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" X-Spam-Status: No, score=-12.5 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: libstdc++@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libstdc++ mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Mar 2022 17:52:35 -0000 Tested powerpc64le-linux, pushed to trunk. -- >8 -- GCC thinks the following can lead to a buffer overflow when __ns.size() equals zero: const basic_string<_CharT>& __ns = __mp.negative_sign(); _M_negative_sign_size = __ns.size(); __negative_sign = new _CharT[_M_negative_sign_size]; __ns.copy(__negative_sign, _M_negative_sign_size); This happens because operator new might be replaced with something that writes to this->_M_negative_sign_size and so the basic_string::copy call could use a non-zero size to write to a zero-length buffer. The solution suggested by Richi is to cache the size in a local variable so that the compiler knows it won't be changed between the allocation and the copy. This commit goes further and rewrites the whole function to use RAII and delay all modifications of *this until after all allocations have succeeded. The RAII helper type caches the size and copies the string and owns the memory until told to release it. libstdc++-v3/ChangeLog: PR middle-end/104966 * include/bits/locale_facets_nonio.tcc (__moneypunct_cache::_M_cache): Replace try-catch with RAII and make all string copies before any stores to *this. --- .../include/bits/locale_facets_nonio.tcc | 100 +++++++++--------- 1 file changed, 50 insertions(+), 50 deletions(-) diff --git a/libstdc++-v3/include/bits/locale_facets_nonio.tcc b/libstdc++-v3/include/bits/locale_facets_nonio.tcc index 98442418f51..8c37a706db8 100644 --- a/libstdc++-v3/include/bits/locale_facets_nonio.tcc +++ b/libstdc++-v3/include/bits/locale_facets_nonio.tcc @@ -71,61 +71,61 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION const moneypunct<_CharT, _Intl>& __mp = use_facet >(__loc); + struct _Scoped_str + { + size_t _M_len; + _CharT* _M_str; + + explicit + _Scoped_str(const basic_string<_CharT>& __str) + : _M_len(__str.size()), _M_str(new _CharT[_M_len]) + { __str.copy(_M_str, _M_len); } + + ~_Scoped_str() { delete[] _M_str; } + + void + _M_release(const _CharT*& __p, size_t& __n) + { + __p = _M_str; + __n = _M_len; + _M_str = 0; + } + }; + + _Scoped_str __curr_symbol(__mp.curr_symbol()); + _Scoped_str __positive_sign(__mp.positive_sign()); + _Scoped_str __negative_sign(__mp.negative_sign()); + + const string& __g = __mp.grouping(); + const size_t __g_size = __g.size(); + char* const __grouping = new char[__g_size]; + __g.copy(__grouping, __g_size); + + // All allocations succeeded without throwing, OK to modify *this now. + + _M_grouping = __grouping; + _M_grouping_size = __g_size; + _M_use_grouping = (__g_size + && static_cast(__grouping[0]) > 0 + && (__grouping[0] + != __gnu_cxx::__numeric_traits::__max)); + _M_decimal_point = __mp.decimal_point(); _M_thousands_sep = __mp.thousands_sep(); + + __curr_symbol._M_release(_M_curr_symbol, _M_curr_symbol_size); + __positive_sign._M_release(_M_positive_sign, _M_positive_sign_size); + __negative_sign._M_release(_M_negative_sign, _M_negative_sign_size); + _M_frac_digits = __mp.frac_digits(); + _M_pos_format = __mp.pos_format(); + _M_neg_format = __mp.neg_format(); - char* __grouping = 0; - _CharT* __curr_symbol = 0; - _CharT* __positive_sign = 0; - _CharT* __negative_sign = 0; - __try - { - const string& __g = __mp.grouping(); - _M_grouping_size = __g.size(); - __grouping = new char[_M_grouping_size]; - __g.copy(__grouping, _M_grouping_size); - _M_use_grouping = (_M_grouping_size - && static_cast(__grouping[0]) > 0 - && (__grouping[0] - != __gnu_cxx::__numeric_traits::__max)); + const ctype<_CharT>& __ct = use_facet >(__loc); + __ct.widen(money_base::_S_atoms, + money_base::_S_atoms + money_base::_S_end, _M_atoms); - const basic_string<_CharT>& __cs = __mp.curr_symbol(); - _M_curr_symbol_size = __cs.size(); - __curr_symbol = new _CharT[_M_curr_symbol_size]; - __cs.copy(__curr_symbol, _M_curr_symbol_size); - - const basic_string<_CharT>& __ps = __mp.positive_sign(); - _M_positive_sign_size = __ps.size(); - __positive_sign = new _CharT[_M_positive_sign_size]; - __ps.copy(__positive_sign, _M_positive_sign_size); - - const basic_string<_CharT>& __ns = __mp.negative_sign(); - _M_negative_sign_size = __ns.size(); - __negative_sign = new _CharT[_M_negative_sign_size]; - __ns.copy(__negative_sign, _M_negative_sign_size); - - _M_pos_format = __mp.pos_format(); - _M_neg_format = __mp.neg_format(); - - const ctype<_CharT>& __ct = use_facet >(__loc); - __ct.widen(money_base::_S_atoms, - money_base::_S_atoms + money_base::_S_end, _M_atoms); - - _M_grouping = __grouping; - _M_curr_symbol = __curr_symbol; - _M_positive_sign = __positive_sign; - _M_negative_sign = __negative_sign; - _M_allocated = true; - } - __catch(...) - { - delete [] __grouping; - delete [] __curr_symbol; - delete [] __positive_sign; - delete [] __negative_sign; - __throw_exception_again; - } + _M_allocated = true; } _GLIBCXX_BEGIN_NAMESPACE_LDBL_OR_CXX11 -- 2.34.1