Fix BZ 18756 (fmemopen(..., 0, ...) does not fail)

[Paul Pluzhnikov]

Greetings,

Attached trivial patch fixes BZ 18756 and adds a test case for it.
Since this is new breakage in 2.22, I say it should go in despite the
hard freeze.

Thanks,

2015-08-02  Paul Pluzhnikov  <ppluzhnikov@google.com>

        [BZ #18756]
        * libio/fmemopen.c (__fmemopen): Check for 0 len.
        * libio/test-fmemopen.c (do_bz18756): New test.

-- 
Paul Pluzhnikov
-------------- next part --------------
diff --git a/libio/fmemopen.c b/libio/fmemopen.c
index 3ab3e8d..c58f376 100644
--- a/libio/fmemopen.c
+++ b/libio/fmemopen.c
@@ -150,6 +150,12 @@ __fmemopen (void *buf, size_t len, const char *mode)
   cookie_io_functions_t iof;
   fmemopen_cookie_t *c;
 
+  if (__glibc_unlikely (len == 0))
+    {
+      __set_errno (EINVAL);
+      return NULL;
+    }
+
   c = (fmemopen_cookie_t *) calloc (sizeof (fmemopen_cookie_t), 1);
   if (c == NULL)
     return NULL;
diff --git a/libio/test-fmemopen.c b/libio/test-fmemopen.c
index 63ca89f..81371fa 100644
--- a/libio/test-fmemopen.c
+++ b/libio/test-fmemopen.c
@@ -24,6 +24,27 @@ static char buffer[] = "foobar";
 #include <errno.h>
 
 static int
+do_bz18756 (void)
+{
+  int ch;
+  int ret = 0;
+  FILE *stream;
+
+  errno = 0;
+  stream = fmemopen (&ch, 0, "w");
+  if (stream != NULL || errno != EINVAL)
+    {
+      printf ("fmemopen zero-sized buffer: stream = %p, %m\n", stream);
+      ret = 1;
+    }
+
+  if (stream != NULL)
+    fclose (stream);
+
+  return ret;
+}
+
+static int
 do_test (void)
 {
   int ch;
@@ -44,7 +65,7 @@ do_test (void)
 
   fclose (stream);
 
-  return ret;
+  return ret + do_bz18756 ();
 }
 
 #define TEST_FUNCTION do_test ()