[PATCH v2] libio: Fix wide stream backup buffer leak on fclose [BZ #33999]

[Andreas Schwab]

On Mär 31 2026, Gao Xiang wrote:

>   - Keeps wmemstream in the test:  Agreed that ungetwc on a wmemstream is not
>     a valid application use.However I was unable to trigger the backup buffer
>     allocation through a tmpfile-based read/ungetwc sequence.

Yes, all file-based stream types (initialized by
_IO_new_file_init_internal which sets _IO_IS_FILEBUF) go through
_IO_file_close_maybe_unlink which already deallocates the backup buffer,
before the finish method is called.

>     Using wmemstream route is the most direct way to reach the leaking code in
>     _IO_wdefault_finish. Open to suggestions if you know a cleaner way to trigger it.

It works because the memstream initializer does not set _IO_NO_READS,
which could be considered a bug.  Perhaps add a comment to the test that
we are depending on this particular implementation quirk.

> diff --git a/libio/tst-wbackup-leak.c b/libio/tst-wbackup-leak.c
> new file mode 100644
> index 0000000000..c5bf128237
> --- /dev/null
> +++ b/libio/tst-wbackup-leak.c
> @@ -0,0 +1,45 @@
> +/* Test _IO_wdefault_finish frees wide backup buffer [BZ #33999].  */
> +
> +#include <malloc.h>
> +#include <stdio.h>
> +#include <wchar.h>
> +#include <support/check.h>
> +
> +static void
> +one_round (void)
> +{
> +  wchar_t *buf = NULL;
> +  size_t size = 0;
> +
> +  FILE *fp = open_wmemstream (&buf, &size);
> +  TEST_VERIFY_EXIT (fp != NULL);
> +  fputwc (L'A', fp);
> +  fflush (fp);
> +  /*·Push·back·without·prior·read.··read_ptr·==·read_base,·so
> +···*··_IO_wdefault_pbackfail·skips·the·buggy·narrow·read_ptr·access
> +···*··(BZ·#33998)·and·goes·straight·to·allocating·a·wide·backup
> +  ·*··buffer·at·fp->_wide_data->_IO_save_base.··*/

Please use regular spaces.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."