[PATCH v3] libio: Fix wide stream backup buffer leak on fclose [BZ #33999]

[Andreas Schwab]

On Apr 02 2026, Gao Xiang wrote:

> diff --git a/libio/tst-wbackup-leak.c b/libio/tst-wbackup-leak.c
> new file mode 100644
> index 0000000000..8a3e0fc1ed
> --- /dev/null
> +++ b/libio/tst-wbackup-leak.c
> @@ -0,0 +1,50 @@
> +/* Test _IO_wdefault_finish frees wide backup buffer [BZ #33999].  */
> +
> +#include <malloc.h>
> +#include <stdio.h>
> +#include <wchar.h>
> +#include <support/check.h>
> +
> +static void
> +one_round (void)
> +{
> +  wchar_t *buf = NULL;
> +  size_t size = 0;
> +
> +  FILE *fp = open_wmemstream (&buf, &size);
> +  TEST_VERIFY_EXIT (fp != NULL);
> +  fputwc (L'A', fp);
> +  fflush (fp);
> +  /* Push back without prior read. read_ptr == read_base, so
> +     _IO_wdefault_pbackfail skips the buggy narrow read_ptr access
> +     (BZ #33998) and goes straight to allocating a wide backup
> +     buffer at fp->_wide_data->_IO_save_base.
> +
> +     Note: this testcase relies on the fact that open_wmemstream
> +     does not set _IO_NO_READS on the stream. If that implementation
> +     is changed, this test would need a different stream type to verify
> +     the leak.  */
> +  ungetwc (L'Z', fp);

When switching from output to input mode a seek is required, so
prepending a rewind (fp) here would be needed.

Ok with that change.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."