[PATCH] tst-scanf-format-real: don't crash on nan()

[Carlos O'Donell]

On 4/10/25 9:25 AM, Andreas Schwab wrote:
> On Apr 10 2025, Carlos O'Donell wrote:
> 
>> On 4/9/25 9:22 AM, Andreas Schwab wrote:
>>> Fix a null-pointer dereference when the expected value is written as
>>> `nan()'.
>>
>> Under what hardware and software combination does bug 32857 trigger?
> 
> This crash is generic.

Thanks.
  
>>
>>> ---
>>>    stdio-common/tst-scanf-format-real.h | 2 +-
>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>> diff --git a/stdio-common/tst-scanf-format-real.h
>>> b/stdio-common/tst-scanf-format-real.h
>>> index 639ac74973..07a276d4ec 100644
>>> --- a/stdio-common/tst-scanf-format-real.h
>>> +++ b/stdio-common/tst-scanf-format-real.h
>>> @@ -201,7 +201,7 @@ out:									\
>>>    	  }								\
>>>    									\
>>>    	size_t seq_size = 0;						\
>>> -	char *seq = NULL;						\
>>> +	char *seq = xstrdup ("");					\
>>
>> The sequence size is now 1, because of the null terminator.
>>
>> Doesn't this mean we need a +1 in the following realloc that increments
>> the sequence by SIZE_CHUNK?
> 
> It works either way.  For an input of "nan()" seq_size isn't actually
> used, and for a non-empty sequence it doesn't matter whether seq is
> initially NULL or not.
> 

May you please post a v2 that accounts for this correctly to avoid this
becoming a problem in the future?

e.g.
diff --git a/stdio-common/tst-scanf-format-real.h b/stdio-common/tst-scanf-format-real.h
index 639ac74973..84330d3755 100644
--- a/stdio-common/tst-scanf-format-real.h
+++ b/stdio-common/tst-scanf-format-real.h
@@ -221,7 +221,7 @@ out:                                                                        \
               if (i == seq_size)                                        \
                 {                                                       \
                   seq_size += SIZE_CHUNK;                               \
-                 seq = xrealloc (seq, seq_size);                       \
+                 seq = xrealloc (seq, seq_size + 1);                   \
                 }                                                       \
               seq[i++] = ch;                                            \
             }                                                           \

-- 
Cheers,
Carlos.