[PATCH 01/20] Fix OOB read in stdlib thousand grouping parsing [BZ #29727]

[Andreas Schwab]

On Okt 27 2022, Szabolcs Nagy via Libc-alpha wrote:

> diff --git a/stdlib/grouping.c b/stdlib/grouping.c
> index be7922f5fd..4622897488 100644
> --- a/stdlib/grouping.c
> +++ b/stdlib/grouping.c
> @@ -64,9 +64,17 @@ __correctly_grouped_prefixmb (const STRING_TYPE *begin, const STRING_TYPE *end,
>    thousands_len = strlen (thousands);
>  #endif
>  
> +#ifdef USE_WIDE_CHAR
>    while (end > begin)
> +#else
> +  while (end - begin >= thousands_len)
> +#endif
>      {
> +#ifdef USE_WIDE_CHAR
>        const STRING_TYPE *cp = end - 1;
> +#else
> +      const STRING_TYPE *cp = end - thousands_len;
> +#endif

This could be simplified by defining a constant thousands_len for the
USE_WIDE_CHAR case.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."