[Bug stdio/26214] New: printf_fp double free

[jsm28 at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26214

            Bug ID: 26214
           Summary: printf_fp double free
           Product: glibc
           Version: 2.32
            Status: NEW
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: jsm28 at gcc dot gnu.org
  Target Milestone: ---

__printf_fp_l has a double free bug in the case where it allocates memory with
malloc internally, then has an I/O error while outputting trailing padding and
tries to free that already-freed memory when the error occurs. The following
test reproduces that bug (with a segfault).

#include <stdio.h>
#include <stdlib.h>

int
main (void)
{
  FILE *fp;
  char buf[131072];
  if ((fp = fopen ("/dev/full", "w")) == NULL)
    exit (1);
  if (setvbuf (fp, buf, _IOFBF, sizeof buf) != 0)
    exit (2);
  fprintf (fp, "%-1000000.65536f", 1.0);
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.