[Bug libc/4977] SEGV in strlen() of string argument of vsnprintf call on RHEL WS3/64-bit

["jakub at redhat dot com" <sourceware-bugzilla at sourceware dot org>]

------- Additional Comments From jakub at redhat dot com  2007-08-29 16:10 -------
Passing it once to some function is just fine.  What your testcase does
wrong is passing the same va_list object to another function, while the standards
say that if you pass it to some function and that function uses va_arg on it,
then the object can be only passed to va_end, nothing else.
On some architectures it can work even multiple times, that's mainly
architectures which define va_list as a pointer (e.g. i386), but note
that doing so is highly unportable.  On other architectures, va_list as is
a one element array containing some structure (e.g. x86_64).  If you pass
that to some function, you just pass its address to it, the object actually
resides in the function which invoked va_start or va_copy, if their argument
is an automatic va_list variable.  So, the first vsnprintf will modify that
va_list object to point after all arguments it consumed and when you call
vsnprintf again with the same va_list (== the same address of some automatic
struct), it will start looking at garbage.

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=4977

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.