[Bug stdio/20938] In variable-width charsets, _IO_wfile_sync passes a negative buffer size to __codecvt_do_length on certain inputs to fgetws resulting in SIGSEGV

[catqueen2 at protonmail dot ch]

https://sourceware.org/bugzilla/show_bug.cgi?id=20938

--- Comment #3 from cat stevens <catqueen2 at protonmail dot ch> ---
Created attachment 9693
  --> https://sourceware.org/bugzilla/attachment.cgi?id=9693&action=edit
Fix wfileops.c to never use a negative delta (swap the pointer subtraction and
always use ssize_t)

I figured out how to run my test program under a different libc, so I cloned
glibc 2.24 and made the changes specified in the patch. I annotated it with a
comment, but the important part is that the end pointer will always be greater
than the 'ptr' which points to the beginning of the string.

I'm not sure why a variable called 'delta' has a signed type (since difference
is usually absolute) but __codecvt_do_length takes a 'size_t' as its last
argument, not a 'ssize_t'. Since the subtraction of these pointers should
always result in an unsigned number, it should be okay to store it in a
'size_t'.

The output of the program in my initial comment was:

$ ~/projects/c/misc/fgetws/f en_US.utf8 3
dddddddddddddddddddddddddddddddddd
[dd], [dd]
still works: yes
Segmentation fault (core dumped)

A segfault after main.

Now, it runs like this: 
$ ./testrun.sh ~/projects/c/misc/fgetws/f en_US.utf8 3
dddddddddddddddddddddddddddddddddd
[dd], [dd]
still works: yes

No segfault, hooray!

-- 
You are receiving this mail because:
You are on the CC list for the bug.