[PATCH 07/15] stdio-common: Fix macro parameter shadowing in scanf input specifier tests

Maciej W. Rozycki macro@orcam.me.uk
Sat Apr 19 10:44:00 GMT 2025


From: Maciej W. Rozycki <macro@redhat.com>

The use of the same name for a local variable combined with passing a 
pointer to it to a nested macro call causes the wrong 'err' variable to 
be updated in 'read_real', because '&err' is only expanded at '*errp' 
evaluation.  Consequently the variable defined in 'read_real' is set 
rather than one in its 'verify_input' caller as it would be the case 
should 'read_real' be a function, leading to invalid input such as:

%a:nan:1:3:nan(:

to be accepted.

Address the issue by renaming the 'err' variable in 'verify_input' to 
'errx', causing such input to be correctly rejected:

error: ./tst-scanf-format-skeleton.c:242: input line 1: input data format error

No test case added as it's a test case issue in the first place.
---
 stdio-common/tst-scanf-format-real.h |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

glibc-tst-scanf-format-all-real-verify-err-fix.diff
Index: glibc/stdio-common/tst-scanf-format-real.h
===================================================================
--- glibc.orig/stdio-common/tst-scanf-format-real.h
+++ glibc/stdio-common/tst-scanf-format-real.h
@@ -73,19 +73,19 @@
 ({									\
   __label__ out;							\
   bool match = true;							\
-  int err = 0;								\
+  int errx = 0;								\
   type_t v;								\
 									\
   initialize_value (v);							\
   /* Make sure it's been committed.  */					\
   __asm__ ("" : : : "memory");						\
-  v = read_real (&err);							\
-  if (err < 0)								\
+  v = read_real (&errx);						\
+  if (errx < 0)								\
     goto out;								\
   match = compare_real (val, v);					\
 									\
 out:									\
-  if (err || !match)							\
+  if (errx || !match)							\
     {									\
       union								\
 	{								\
@@ -104,7 +104,7 @@ out:									\
       printf ("'\n");							\
     }									\
 									\
-  *errp = err;								\
+  *errp = errx;								\
   match;								\
 })
 


More information about the Libc-alpha mailing list