public inbox for newlib-cvs@sourceware.org
help / color / mirror / Atom feed
* [newlib-cygwin] Don't overread or write memory returned by _DTOA_R
@ 2017-06-09 13:32 Corinna Vinschen
0 siblings, 0 replies; only message in thread
From: Corinna Vinschen @ 2017-06-09 13:32 UTC (permalink / raw)
To: newlib-cvs
https://sourceware.org/git/gitweb.cgi?p=newlib-cygwin.git;h=efaef1bba263501e1e7264833ddfc9b8c20f9ebc
commit efaef1bba263501e1e7264833ddfc9b8c20f9ebc
Author: Silviu Baranga <silviu.baranga@arm.cm>
Date: Mon Jun 5 09:54:42 2017 +0100
Don't overread or write memory returned by _DTOA_R
Don't over-read memory returned by _DTOA_R, and never write to it
since the result might be a string literal.
For example, when doing:
swprintf(tt, 20, L"%.*f", 6, 0.0);
we will get back "0".
Instead, write the result returned by _DTOA_R to the output buffer.
After this, write the 0 chars directly to the the output buffer
(if there are any). This also has the (marginal) advantage that
we read/write less memory overall.
Diff:
---
newlib/libc/stdio/vfwprintf.c | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/newlib/libc/stdio/vfwprintf.c b/newlib/libc/stdio/vfwprintf.c
index 4786ed6..f0872fd 100644
--- a/newlib/libc/stdio/vfwprintf.c
+++ b/newlib/libc/stdio/vfwprintf.c
@@ -1631,12 +1631,18 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags,
{
char *digits, *bp, *rve;
-#ifndef _MB_CAPABLE
int i;
-#endif
digits = _DTOA_R (data, value, mode, ndigits, decpt, &dsgn, &rve);
+#ifdef _MB_CAPABLE
+ _mbsnrtowcs_r (data, buf, (const char **) &digits, rve - digits,
+ len, NULL);
+#else
+ for (i = 0; i < rve - digits && i < len; ++i)
+ buf[i] = (wchar_t) digits[i];
+#endif
+
if ((ch != L'g' && ch != L'G') || flags & ALT) { /* Print trailing zeros */
bp = digits + ndigits;
if (ch == L'f' || ch == L'F') {
@@ -1646,18 +1652,13 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags,
}
if (value == 0) /* kludge for __dtoa irregularity */
rve = bp;
- while (rve < bp)
- *rve++ = '0';
- }
+ for (i = rve - digits; i < bp - digits && i < len; ++i)
+ buf[i] = L'0';
+
+ rve = rve > bp ? rve : bp;
+ }
*length = rve - digits; /* full length of the string */
-#ifdef _MB_CAPABLE
- _mbsnrtowcs_r (data, buf, (const char **) &digits, *length,
- len, NULL);
-#else
- for (i = 0; i < *length && i < len; ++i)
- buf[i] = (wchar_t) digits[i];
-#endif
return buf;
}
}
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2017-06-09 13:32 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-09 13:32 [newlib-cygwin] Don't overread or write memory returned by _DTOA_R Corinna Vinschen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).