[ECOS] sscanf() exception issue of C lib

[Xiaochen Zhou]

Hi, All

An exception was found in my ecos application. It raised three times in
a months and is very diffcult to repeat. I backtraced it and list below:

Check_IP() -> sscanf() -> vsscanf() ->
vfscanf()->Cyg_StdioStream::refill_read_buffer() ->
cyg_libc_stdio_flush_all_but() -> Cyg_Mutex::lock()

int Check_IP(char* str)
{
int i;
int ip[4];
char tmp[16];

if (!str)
return -1;

if (sscanf(str, "%d.%d.%d.%d%s", &ip[0], &ip[1], &ip[2], &ip[3], tmp) != 4)
return -1;

for (i = 0; i <= 3; i++)
{
if (ip[i] < 0 || ip[i] > 255)
return -1;
}

return 1;
}

I try hard to check my code, but does not work. At last I browse the c
lib code, and have some doubts with the
language/c/libc/stdio/current/src/common/fflush.cxx

// flush all but one stream
externC Cyg_ErrNo
cyg_libc_stdio_flush_all_but( Cyg_StdioStream *not_this_stream )
{
cyg_bool files_flushed[FOPEN_MAX] = { false }; // sets all to 0
----------------> (1)
cyg_bool loop_again, looped = false;
cyg_ucount32 i;
Cyg_ErrNo err=ENOERR;
Cyg_StdioStream *stream;

do {
loop_again = false;

for (i=0; (i<FOPEN_MAX) && !err; i++) {
if (files_flushed[i] == false) {

stream = Cyg_libc_stdio_files::get_file_stream(i); ----------------->(2)
...................

}

(1) only initialize the files_flushed[0] , not all elements.

(2) Cyg_libc_stdio_files::get_file_stream(i) is not safe here. I think
it should need Cyg_libc_stdio_files::lock() &
Cyg_libc_stdio_files::unlock() to protect.

I'm not sure of this, can someone affirm? thanks!

Regards,
Xiaochen Zhou

-- 
Before posting, please read the FAQ: http://ecos.sourceware.org/fom/ecos
and search the list archive: http://ecos.sourceware.org/ml/ecos-discuss