From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTPS id 725F13858CDB for ; Thu, 10 Aug 2023 22:40:39 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 725F13858CDB Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1691707239; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=oL+ZJv73pYlOTt98ruZ0bRt9As+XBREDxXyO72yW33I=; b=ZQIkyilFanyNg6TXVSuE6PitjoQukiRWWe+AvZ3bonR5sfn53s4/fA27dXgObSCz9rNLOH 7NGCsgmTeIb57XXkIB65CJPRGxjw9jAcbkNt9tZRizGQYabPlyC7y0/DJtyi8E7IssN7xi iM921d5feUU6oR3wTPC14wK196c05KA= Received: from mimecast-mx02.redhat.com (66.187.233.73 [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-295-XzwSS8wFMFWZ3cej9FgTJg-1; Thu, 10 Aug 2023 18:40:36 -0400 X-MC-Unique: XzwSS8wFMFWZ3cej9FgTJg-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id C68782A59562; Thu, 10 Aug 2023 22:40:35 +0000 (UTC) Received: from localhost (unknown [10.42.28.188]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8E0552026D4B; Thu, 10 Aug 2023 22:40:35 +0000 (UTC) From: Jonathan Wakely To: libstdc++@gcc.gnu.org, gcc-patches@gcc.gnu.org Subject: [committed] libstdc++: Fix out-of-bounds read in format string "{:{}." [PR110974] Date: Thu, 10 Aug 2023 23:40:03 +0100 Message-ID: <20230810224034.1259089-1-jwakely@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.4 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-12.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Tested x86_64-linux. Pushed to trunk. Backport to gcc-13 to follow. -- >8 -- libstdc++-v3/ChangeLog: PR libstdc++/110974 * include/std/format (_Spec::_S_parse_width_or_precision): Check for empty range before dereferencing iterator. * testsuite/std/format/string.cc: Check for expected exception. Fix expected exception message in test_pr110862() and actually call it. --- libstdc++-v3/include/std/format | 7 ++++--- libstdc++-v3/testsuite/std/format/string.cc | 21 ++++++++++++++++++++- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/libstdc++-v3/include/std/format b/libstdc++-v3/include/std/format index 5d7af53fc94..2fe430f75f6 100644 --- a/libstdc++-v3/include/std/format +++ b/libstdc++-v3/include/std/format @@ -520,10 +520,11 @@ namespace __format if (__first[0] != '.') return __first; - ++__first; + iterator __next = ++__first; bool __arg_id = false; - auto __next = _S_parse_width_or_precision(__first, __last, _M_prec, - __arg_id, __pc); + if (__next != __last) + __next = _S_parse_width_or_precision(__first, __last, _M_prec, + __arg_id, __pc); if (__next == __first) __throw_format_error("format error: missing precision after '.' in " "format string"); diff --git a/libstdc++-v3/testsuite/std/format/string.cc b/libstdc++-v3/testsuite/std/format/string.cc index 6a45237b8c4..fef55b9bcd9 100644 --- a/libstdc++-v3/testsuite/std/format/string.cc +++ b/libstdc++-v3/testsuite/std/format/string.cc @@ -137,7 +137,24 @@ test_pr110862() VERIFY( false ); } catch (const std::format_error& e) { std::string_view what = e.what(); - VERIFY( what.find("unmatched left brace") != what.npos ); + VERIFY( what.find("unmatched '{'") != what.npos ); + } +} + +void +test_pr110974() +{ + try { + // PR libstdc++/110974 out of bounds read on invalid format string "{:{}." + std::string_view fmt{"{:{}.0", 5}; // "0" is not part of the format string. + (void) std::vformat(fmt, std::make_format_args(1.0, 1)); + VERIFY( false ); + } catch (const std::format_error& e) { + std::string_view what = e.what(); + // GCC 13.2 throws "invalid width or precision in format-spec" after + // trying to parse the "0" past-the-end of the format string. + // There should be an exception before even trying that: + VERIFY( what.find("missing precision after '.'") != what.npos ); } } @@ -146,4 +163,6 @@ int main() test_no_args(); test_indexing(); test_format_spec(); + test_pr110862(); + test_pr110974(); } -- 2.41.0