Bug 18756 - fmemopen succeeds when size is zero
Summary: fmemopen succeeds when size is zero
Status: RESOLVED DUPLICATE of bug 11216
Alias: None
Product: glibc
Classification: Unclassified
Component: stdio (show other bugs)
Version: 2.21
: P2 normal
Target Milestone: ---
Assignee: Paul Pluzhnikov
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-01 18:16 UTC by Martin Sebor
Modified: 2015-09-04 09:31 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Sebor 2015-08-01 18:16:50 UTC
POSIX specifies the fmemopen() function shall fail with EINVAL when the size argument specifies a buffer size of zero. When compiled with the top of trunk, the program below aborts indicating that glibc fails to conform to this requirement.

#include <assert.h>
#include <errno.h>
#include <stdio.h>

int main (void)
{
    char c = 0;
    FILE *f = fmemopen (&c, 0, "w");
    printf ("%p, errno = %m\n", f);
    assert (f == 0 && errno == EINVAL);
    return 0;
}
0x100002f0040, errno = Success
a.out: /build/tmp/t.c:10: main: Assertion `f == 0 && (*__errno_location ()) == 22' failed.
Comment 1 Paul Pluzhnikov 2015-08-02 19:32:37 UTC
Confirmed. The __old_fmemopen, aka fmemopen@GLIBC_2.2.5 works correctly, but the fmemopen@@GLIBC_2.22 does not.
Comment 2 Andreas Schwab 2015-08-03 14:10:53 UTC
See <http://austingroupbugs.net/view.php?id=818#c2184>.

*** This bug has been marked as a duplicate of bug 11216 ***