Re: Fix modification of string literal by swprintf

[Corinna Vinschen <vinschen@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 4037 bytes --]

On Jun  5 09:59, Thomas Preudhomme wrote:
> Don't over-read memory returned by _DTOA_R, and never write to it
> since the result might be a string literal.
> 
> For example, when doing:
>   swprintf(tt, 20, L"%.*f", 6, 0.0);
> 
> we will get back "0".
> 
> Instead, write the result returned by _DTOA_R to the output buffer.
> After this, write the 0 chars directly to the the output buffer
> (if there are any). This also has the (marginal) advantage that
> we read/write less memory overall.
> 
> The patch, contributed by Silviu Baranga was tested against libcxx testsuite
> and showed no regression. Please find the patch in git format-patch format
> in attachment.
> 
> Best regards,
> 
> Thomas

> >From 7a31cfb01a0b089daf2bed93b742b6edbf4cba0c Mon Sep 17 00:00:00 2001
> From: Silviu Baranga <silviu.baranga@arm.cm>
> Date: Mon, 5 Jun 2017 09:54:42 +0100
> Subject: [PATCH] Don't overread or write memory returned by _DTOA_R
> 
> Don't over-read memory returned by _DTOA_R, and never write to it
> since the result might be a string literal.
> 
> For example, when doing:
>   swprintf(tt, 20, L"%.*f", 6, 0.0);
> 
> we will get back "0".
> 
> Instead, write the result returned by _DTOA_R to the output buffer.
> After this, write the 0 chars directly to the the output buffer
> (if there are any). This also has the (marginal) advantage that
> we read/write less memory overall.
> ---
>  newlib/libc/locale/setlocale.h |  2 +-
>  newlib/libc/stdio/vfwprintf.c  | 24 ++++++++++++------------
>  2 files changed, 13 insertions(+), 13 deletions(-)
> 
> diff --git a/newlib/libc/locale/setlocale.h b/newlib/libc/locale/setlocale.h
> index 85a38d5..1440d0e 100644
> --- a/newlib/libc/locale/setlocale.h
> +++ b/newlib/libc/locale/setlocale.h
> @@ -227,7 +227,7 @@ __get_locale_r (struct _reent *r)
>  _ELIDABLE_INLINE struct __locale_t *
>  __get_current_locale (void)
>  {
> -  return _REENT->_locale ?: __get_global_locale ();
> +  return _REENT->_locale ?: __get_global_locale (); // version for !_MB_CAPABLE?
>  }

This doesn't belong here.  Also, the code is already fine for !_MB_CAPABLE
as well.

>  /* Only access fixed "C" locale using this function.  Fake for !_MB_CAPABLE
> diff --git a/newlib/libc/stdio/vfwprintf.c b/newlib/libc/stdio/vfwprintf.c
> index f0179a0..1bec9b2 100644
> --- a/newlib/libc/stdio/vfwprintf.c
> +++ b/newlib/libc/stdio/vfwprintf.c
> @@ -1627,13 +1627,20 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags,
>  
>  	{
>  	  char *digits, *bp, *rve;
> -#ifndef _MB_CAPABLE
>  	  int i;
> -#endif
>  
>  	  digits = _DTOA_R (data, value, mode, ndigits, decpt, &dsgn, &rve);
>  
> +#ifdef _MB_CAPABLE
> +	  _mbsnrtowcs_r (data, buf, (const char **) &digits, rve - digits,
> +			 len, NULL);
> +#else
> +	  for (i = 0; i < rve - digits && i < len; ++i)
> +	    buf[i] = (wchar_t) digits[i];
> +#endif
> +
>  	  if ((ch != L'g' && ch != L'G') || flags & ALT) {	/* Print trailing zeros */
> +		char *padding = rve;
>  		bp = digits + ndigits;
>  		if (ch == L'f' || ch == L'F') {
>  			if (*digits == L'0' && value)
> @@ -1642,18 +1649,11 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags,
>  		}
>  		if (value == 0)	/* kludge for __dtoa irregularity */
>  			rve = bp;
> -		while (rve < bp)
> -			*rve++ = '0';
> -	  }
>  
> +		for (i = padding - digits; i < rve - digits && i < len; ++i)
> +			buf[i] = L'0';

Appending zeros here without incrementing rve...

> +	  }
>  	  *length = rve - digits; /* full length of the string */

...leads to incorrect setting of *length here.  Or am I missing
something?

> -#ifdef _MB_CAPABLE
> -	  _mbsnrtowcs_r (data, buf, (const char **) &digits, *length,
> -			 len, NULL);
> -#else
> -	  for (i = 0; i < *length && i < len; ++i)
> -	    buf[i] = (wchar_t) digits[i];
> -#endif
>  	  return buf;
>  	}
>  }
> -- 
> 1.9.1
> 

Corinna

-- 
Corinna Vinschen
Cygwin Maintainer
Red Hat

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]