From: Keith Packard <keithp@keithp.com>
To: Corinna Vinschen <vinschen@redhat.com>, newlib@sourceware.org
Subject: Re: [PATCH] svfwscanf: Simplify _sungetwc_r to eliminate apparent buffer overflow
Date: Wed, 18 Aug 2021 09:50:09 -0700 [thread overview]
Message-ID: <878s0yd7em.fsf@keithp.com> (raw)
In-Reply-To: <87bl5ud8bq.fsf@keithp.com>
[-- Attachment #1: Type: text/plain, Size: 1342 bytes --]
Keith Packard <keithp@keithp.com> writes:
> A reasonable alternative would be to have the wchar_t version call the
> char version multiple times, instead of just doing it inline; that would
> avoid any semantic difference, which seems like a feature. I'll post a
> patch that does it this way shortly and see which you prefer.
Never mind -- the wchar_t function cannot simply call the char version
as that would require converting to multi-byte so that EOF is handled
correctly, *and* would end up breaking the getchar function which
assumes that the unget buffer has wchar_t values, not multibyte values.
After looking at the code further and discovering numerous other bugs in
this path, I think we should just use the patch as submitted; I cannot
imagine a case where POSIX would change the semantics of scanf to ever
re-write the input with different characters.
other bugs:
1. Assumes wchar_t is 2 bytes by setting the bytes remaining (_r) to 2.
2. Computes the pointer value by subtracting the wchar_t size from the
_ubuf size, resulting in an unaligned pointer. Then uses this
pointer directly in both getwc and ungetwc, which will cause a bus
error on processors unable to access unaligned data.
We could also simplify the matching code path in vfscanf.c at some
point.
--
-keith
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
next prev parent reply other threads:[~2021-08-18 16:50 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-17 19:11 Keith Packard
2021-08-18 8:59 ` Corinna Vinschen
2021-08-18 16:30 ` Keith Packard
2021-08-18 16:50 ` Keith Packard [this message]
2021-08-19 10:10 ` Corinna Vinschen
2021-08-19 15:17 ` Keith Packard
2021-08-19 15:38 ` Corinna Vinschen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=878s0yd7em.fsf@keithp.com \
--to=keithp@keithp.com \
--cc=newlib@sourceware.org \
--cc=vinschen@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).