From 7a31cfb01a0b089daf2bed93b742b6edbf4cba0c Mon Sep 17 00:00:00 2001 From: Silviu Baranga Date: Mon, 5 Jun 2017 09:54:42 +0100 Subject: [PATCH] Don't overread or write memory returned by _DTOA_R Don't over-read memory returned by _DTOA_R, and never write to it since the result might be a string literal. For example, when doing: swprintf(tt, 20, L"%.*f", 6, 0.0); we will get back "0". Instead, write the result returned by _DTOA_R to the output buffer. After this, write the 0 chars directly to the the output buffer (if there are any). This also has the (marginal) advantage that we read/write less memory overall. --- newlib/libc/locale/setlocale.h | 2 +- newlib/libc/stdio/vfwprintf.c | 24 ++++++++++++------------ 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/newlib/libc/locale/setlocale.h b/newlib/libc/locale/setlocale.h index 85a38d5..1440d0e 100644 --- a/newlib/libc/locale/setlocale.h +++ b/newlib/libc/locale/setlocale.h @@ -227,7 +227,7 @@ __get_locale_r (struct _reent *r) _ELIDABLE_INLINE struct __locale_t * __get_current_locale (void) { - return _REENT->_locale ?: __get_global_locale (); + return _REENT->_locale ?: __get_global_locale (); // version for !_MB_CAPABLE? } /* Only access fixed "C" locale using this function. Fake for !_MB_CAPABLE diff --git a/newlib/libc/stdio/vfwprintf.c b/newlib/libc/stdio/vfwprintf.c index f0179a0..1bec9b2 100644 --- a/newlib/libc/stdio/vfwprintf.c +++ b/newlib/libc/stdio/vfwprintf.c @@ -1627,13 +1627,20 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags, { char *digits, *bp, *rve; -#ifndef _MB_CAPABLE int i; -#endif digits = _DTOA_R (data, value, mode, ndigits, decpt, &dsgn, &rve); +#ifdef _MB_CAPABLE + _mbsnrtowcs_r (data, buf, (const char **) &digits, rve - digits, + len, NULL); +#else + for (i = 0; i < rve - digits && i < len; ++i) + buf[i] = (wchar_t) digits[i]; +#endif + if ((ch != L'g' && ch != L'G') || flags & ALT) { /* Print trailing zeros */ + char *padding = rve; bp = digits + ndigits; if (ch == L'f' || ch == L'F') { if (*digits == L'0' && value) @@ -1642,18 +1649,11 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags, } if (value == 0) /* kludge for __dtoa irregularity */ rve = bp; - while (rve < bp) - *rve++ = '0'; - } + for (i = padding - digits; i < rve - digits && i < len; ++i) + buf[i] = L'0'; + } *length = rve - digits; /* full length of the string */ -#ifdef _MB_CAPABLE - _mbsnrtowcs_r (data, buf, (const char **) &digits, *length, - len, NULL); -#else - for (i = 0; i < *length && i < len; ++i) - buf[i] = (wchar_t) digits[i]; -#endif return buf; } } -- 1.9.1