Bug 19476

Summary:	fgetc reads from a stream at EOF
Product:	glibc	Reporter:	Martin Sebor <msebor>
Component:	stdio	Assignee:	Not yet assigned to anyone <unassigned>
Status:	RESOLVED DUPLICATE
Severity:	normal	CC:	fweimer, jeremip11
Priority:	P2	Flags:	fweimer: security-
Version:	2.23
Target Milestone:	---
Host:		Target:
Build:		Last reconfirmed:

Description Martin Sebor 2016-01-15 23:29:20 UTC

C and POSIX require that fgetc() fail with EOF when the stream's EOF state is set.  The test case below shows that glibc violates this requirement.

Now that I've spent time creating a test case and was about to submit the bug I noticed (thanks to Bugzilla's Possible Duplicates feature) that there are already are a number of bugs about this: the oldest one being bug 1190, still in an Assigned state, plus bug 12351 Resolved as Worksforsome.

Since I think ths test case is easier to integrate into the test suite than any of the others I will go ahead and submit this bug anyway and close it as a duplicate.  If it's ever fixed, the test case can be used.

#include <assert.h>
#include <errno.h>
#include <stdio.h>

int main (void)
{
  errno = 0;
  FILE *fout = fopen ("/tmp/testfile", "w");
  if (!fout) {
    printf ("fopen failed for writing: %s\n", strerror (errno));
    return 1;
  }
  
  fprintf (fout, "abc\n");
  fflush (fout);
    
  FILE *fin = fopen ("/tmp/testfile", "r");
  if (!fin) {
    printf ("fopen failed for reading: %s\n", strerror (errno));
    return 1;
  }

  // Reach EOF.
  while (EOF != fgetc (fin))
    ;

  if (ferror (fin)) {
    printf ("ferror: %s\n", strerror (errno));
    return 1;
  }

  // Append to the file.
  if (2 != fprintf (fout, "d\n")) {
    printf ("fprintf failed: %s\n", strerror (errno));
    return 1;
  }
    
  fclose (fout);

  // Verify the input stream is at EOF.
  assert (feof (fin));

  /* From SUSv4, fgetc:

   DESCRIPTION
       If the end-of-file indicator for the input stream pointed to by
       stream is not set and a next byte is present, the fgetc() function
       shall obtain the next byte...

   RETURN VALUE
       If the end-of-file indicator for the stream is set, or if the stream
       is at end-of-file, the end-of-file indicator for the stream shall be
       set and fgetc() shall return EOF.  */
  
  int c = fgetc (fin);

  printf ("fgetc() = %i, feof() = %i\n", c, feof (fin));
  assert (EOF == c && feof (fin));
  
  return 0;
}

Comment 1 Martin Sebor 2016-01-15 23:30:32 UTC

Duplicate of the ancient 1190.

*** This bug has been marked as a duplicate of bug 1190 ***

Comment 2 Sourceware Commits 2018-02-22 00:24:08 UTC

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, zack/sticky-eof has been created
        at  b8efec55de001d0f2517a8a7037673ef931336e9 (commit)

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b8efec55de001d0f2517a8a7037673ef931336e9

commit b8efec55de001d0f2517a8a7037673ef931336e9
Author: Zack Weinberg <zackw@panix.com>
Date:   Wed Feb 21 19:12:51 2018 -0500

    [BZ 1190] Make EOF sticky in stdio.
    
    C99 specifies that the EOF condition on a file is "sticky": once EOF
    has been encountered, all subsequent reads should continue to return
    EOF until the file is closed or something clears the "end-of-file
    indicator" (e.g. fseek, clearerr).  This is arguably a change from
    C89, where the wording was ambiguous; the BSDs always had sticky EOF,
    but the System V lineage would attempt to read from the underlying fd
    again.  GNU libc has followed System V for as long as we've been
    using libio---the relevant chunk of code is
    
        int
        _IO_new_file_underflow (_IO_FILE *fp)
        {
          _IO_ssize_t count;
        #if 0
          /* SysV does not make this test; take it out for compatibility */
          if (fp->_flags & _IO_EOF_SEEN)
            return (EOF);
        #endif
    
    That's been unchanged since before 1995.  This only matters if the
    underlying file has changed in the meantime, of course; perhaps that's
    why nobody got around to filing a bug report until 2005, six years
    after C99 was published.  And nobody took that bug seriously until
    2012, at which time there was a long but inconclusive discussion on
    libc-alpha regarding whether it would break applications to change
    anything, see <https://sourceware.org/ml/libc-alpha/2012-09/msg00343.html>.
    
    It is my considered opinion that we should just go ahead and fix the
    bug, and that a backward compatibility mode is not required, because
    the BSDs have always had sticky EOF, so portable code has always had
    to be prepared to deal with that behavior.  Nowadays, the lineages we
    should be worrying most about compatibility with are all BSD-derived,
    anyway.  Thus, this patch.
    
    You might wonder if changing the _underflow impls is sufficient to
    apply the C99 semantics to all of the many stdio functions that
    perform input.  It should be enough to cover all paths to _IO_SYSREAD,
    and the only other functions that call _IO_SYSREAD are the _seekoff
    impls, which is OK because seeking clears EOF, and the _xsgetn impls,
    which, as far as I can tell, are unused within glibc.
    
    There is some question as to whether the test case in bug #19476
    (one of the several duplicate bug reports) is valid, so instead I have
    written a test case that uses a pseudoterminal to set up the necessary
    conditions -- actually two test cases, one for narrow and one for wide
    streams.  To facilitate this I added a new test-support function that
    sets up a pair of pty file descriptors for you; it's almost the same
    as BSD openpty, the only differences are that it allocates the
    optionally-returned tty pathname with malloc, and that it crashes if
    anything goes wrong.
    
    zw
    
    	[BZ 1190]
    	* libio/fileops.c (_IO_new_file_underflow): Return EOF immediately
    	if the _IO_EOF_SEEN bit is already set; update commentary.
    	* libio/oldfileops.c (_IO_old_file_underflow): Likewise.
    	* libio/wfileops.c (_IO_wfile_underflow): Likewise.
    
    	* support/support_openpty.c, support/tty.h: New files.
    	* support/Makefile (libsupport-routines): Add support_openpty.
    
    	* libio/tst-fgetc-after-eof.c, wcsmbs/test-fgetwc-after-eof.c:
    	New test cases.
    	* libio/Makefile (tests): Add tst-fgetc-after-eof.
    	* wcsmbs/Makefile (tests): Add tst-fgetwc-after-eof.

-----------------------------------------------------------------------

Comment 3 Sourceware Commits 2018-03-13 12:33:45 UTC

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  2cc7bad0ae0a412e75270be5ed41d45c03e7a931 (commit)
      from  778f1974863d63e858b6d0105e41d6f0c30732d3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=2cc7bad0ae0a412e75270be5ed41d45c03e7a931

commit 2cc7bad0ae0a412e75270be5ed41d45c03e7a931
Author: Zack Weinberg <zackw@panix.com>
Date:   Wed Feb 21 19:12:51 2018 -0500

    [BZ 1190] Make EOF sticky in stdio.
    
    C99 specifies that the EOF condition on a file is "sticky": once EOF
    has been encountered, all subsequent reads should continue to return
    EOF until the file is closed or something clears the "end-of-file
    indicator" (e.g. fseek, clearerr).  This is arguably a change from
    C89, where the wording was ambiguous; the BSDs always had sticky EOF,
    but the System V lineage would attempt to read from the underlying fd
    again.  GNU libc has followed System V for as long as we've been
    using libio, but nowadays C99 conformance and BSD compatibility are
    more important than System V compatibility.
    
    You might wonder if changing the _underflow impls is sufficient to
    apply the C99 semantics to all of the many stdio functions that
    perform input.  It should be enough to cover all paths to _IO_SYSREAD,
    and the only other functions that call _IO_SYSREAD are the _seekoff
    impls, which is OK because seeking clears EOF, and the _xsgetn impls,
    which, as far as I can tell, are unused within glibc.
    
    The test programs in this patch use a pseudoterminal to set up the
    necessary conditions.  To facilitate this I added a new test-support
    function that sets up a pair of pty file descriptors for you; it's
    almost the same as BSD openpty, the only differences are that it
    allocates the optionally-returned tty pathname with malloc, and that
    it crashes if anything goes wrong.
    
    	[BZ #1190]
            [BZ #19476]
    	* libio/fileops.c (_IO_new_file_underflow): Return EOF immediately
    	if the _IO_EOF_SEEN bit is already set; update commentary.
    	* libio/oldfileops.c (_IO_old_file_underflow): Likewise.
    	* libio/wfileops.c (_IO_wfile_underflow): Likewise.
    
    	* support/support_openpty.c, support/tty.h: New files.
    	* support/Makefile (libsupport-routines): Add support_openpty.
    
    	* libio/tst-fgetc-after-eof.c, wcsmbs/test-fgetwc-after-eof.c:
    	New test cases.
    	* libio/Makefile (tests): Add tst-fgetc-after-eof.
    	* wcsmbs/Makefile (tests): Add tst-fgetwc-after-eof.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                     |   17 ++++++
 NEWS                          |    8 +++
 libio/Makefile                |    3 +-
 libio/fileops.c               |    7 +--
 libio/oldfileops.c            |    7 +--
 libio/tst-fgetc-after-eof.c   |  109 +++++++++++++++++++++++++++++++++++++++
 libio/wfileops.c              |    4 ++
 support/Makefile              |    1 +
 support/support_openpty.c     |  109 +++++++++++++++++++++++++++++++++++++++
 support/tty.h                 |   45 ++++++++++++++++
 wcsmbs/Makefile               |    2 +-
 wcsmbs/tst-fgetwc-after-eof.c |  114 +++++++++++++++++++++++++++++++++++++++++
 12 files changed, 416 insertions(+), 10 deletions(-)
 create mode 100644 libio/tst-fgetc-after-eof.c
 create mode 100644 support/support_openpty.c
 create mode 100644 support/tty.h
 create mode 100644 wcsmbs/tst-fgetwc-after-eof.c