[Bug stdio/34020] New: libio: ungetc set invalid _IO_save_base in pbackfail branch

[marocketbd at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=34020

            Bug ID: 34020
           Summary: libio: ungetc set invalid _IO_save_base in pbackfail
                    branch
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: marocketbd at gmail dot com
  Target Milestone: ---

I attached a poc below to indicate the issue: when ungetc failed to push back
read_ptr directly, it will allocate a new buffer, that's ok; but at
libio/genops.c:1022, _IO_read_base is updated to _IO_read_ptr, and
_IO_save_base is swapped with _IO_read_base in line 1023, so now _IO_save_base
is no longer free-able pointer.

Then fclose checks _IO_save_base, found it's neither 0 nor _short_backupbuf, so
free it, leading to free error.

It seems that this bug is introduced in very first commit of genops.c, quite
old.

---

#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
int main(void) {
    char *buf = NULL;
    size_t size = 0;
    FILE *fp = open_memstream(&buf, &size);
    fputc('A', fp);
    fflush(fp);

    fgetc(fp);
    ungetc('B', fp);

    fclose(fp);
    free(buf);

    return 0;
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.