From: Joseph Myers <joseph@codesourcery.com>
Date: Wed, 11 Jan 2017 13:59:01 +0000 (+0000)
Subject: Fix ld-address format-truncation error.
X-Git-Tag: glibc-2.25~49
X-Git-Url: https://sourceware.org/git/?a=commitdiff_plain;h=436cfba0abf749e5993b52dce589bae482f8c58a;p=glibc.git

Fix ld-address format-truncation error.

With the elf/sotruss-lib.c failure fixed, building 64-bit glibc with
GCC mainline fails with another format-truncation error in
locale/programs/ld-address.c, where 11 bytes are allocated for a
buffer to print a long int value.

This patch changes that code to allocate 21 bytes.  Treating this
value as signed is questionable and I don't think large values are
actually useful here, but I think those can be considered as instances
of bug 21036 which I've filed for overflow checks for numeric values
in localedef in general, and don't need to be addressed to fix the
build.

Tested with GCC mainline with compilation for aarch64 with
build-many-glibcs.py, and with glibc testsuite for x86_64 (built with
GCC 6).

(Note that while this fixes the build of 64-bit glibc with GCC
mainline, further fixes will be needed to get the testsuite building
with GCC mainline again.)

	* locale/programs/ld-address.c (INT_STR_ELEM): Increase size of
	buffer used to print long int value.
---

diff --git a/ChangeLog b/ChangeLog
index fe612a80b9..8e784b8fd8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2017-01-11  Joseph Myers  <joseph@codesourcery.com>
 
+	* locale/programs/ld-address.c (INT_STR_ELEM): Increase size of
+	buffer used to print long int value.
+
 	* elf/sotruss-lib.c (init): Increase space allocated for pid by
 	one byte.  Print it with %ld, cast to long int.
 
diff --git a/locale/programs/ld-address.c b/locale/programs/ld-address.c
index 3c13e68af3..2488a5ce5c 100644
--- a/locale/programs/ld-address.c
+++ b/locale/programs/ld-address.c
@@ -485,8 +485,8 @@ address_read (struct linereader *ldfile, struct localedef_t *result,
 		address->cat = arg->val.str.startmb;			      \
 	      else							      \
 		{							      \
-		  char *numbuf = (char *) xmalloc (11);			      \
-		  snprintf (numbuf, 11, "%ld", arg->val.num);		      \
+		  char *numbuf = (char *) xmalloc (21);			      \
+		  snprintf (numbuf, 21, "%ld", arg->val.num);		      \
 		  address->cat = numbuf;				      \
 		}							      \
 	    }								      \