[PATCH] libio: Fix wide stream backup buffer leak on fclose [BZ #33999]

[Andreas Schwab]

On Mär 31 2026, Gao Xiang wrote:

> diff --git a/libio/genops.c b/libio/genops.c
> index cc1684e00a..6cd2be7242 100644
> --- a/libio/genops.c
> +++ b/libio/genops.c
> @@ -637,10 +637,7 @@ _IO_default_finish (FILE *fp, int dummy)
>      mark->_sbuf = NULL;
>  
>    if (fp->_IO_save_base)
> -    {
> -      _IO_free_backup_buf (fp, fp->_IO_save_base);
> -      fp->_IO_save_base = NULL;
> -    }
> +    _IO_free_backup_area (fp); 

The condition should be _IO_have_backup, like all other uses of
_IO_free_backup_area.

> diff --git a/libio/tst-wbackup-leak.c b/libio/tst-wbackup-leak.c
> new file mode 100644
> index 0000000000..c9b534ca12
> --- /dev/null
> +++ b/libio/tst-wbackup-leak.c
> @@ -0,0 +1,45 @@
> +/* Test _IO_wdefault_finish frees wide backup buffer [BZ #33999].  */
> +
> +#include <malloc.h>
> +#include <stdio.h>
> +#include <wchar.h>
> +#include <support/check.h>
> +
> +static void
> +one_round (void)
> +{
> +  wchar_t *buf = NULL;
> +  size_t size = 0;
> +
> +  FILE *fp = open_wmemstream (&buf, &size);
> +  TEST_VERIFY_EXIT (fp != NULL);
> +  fputwc (L'A', fp);
> +  fflush (fp);
> +  /* Push back without prior read.  read_ptr == read_base, so
> +   *  _IO_wdefault_pbackfail skips the buggy narrow read_ptr access
> +   *  (BZ #33998) and goes straight to allocating a wide backup
> +   *  buffer at fp->_wide_data->_IO_save_base.  */
> +  ungetwc (L'Z', fp);

This is an invalid use of a memstream, which is an output stream only.

> diff --git a/libio/wgenops.c b/libio/wgenops.c
> index 064d71266d..6c07cdfeca 100644
> --- a/libio/wgenops.c
> +++ b/libio/wgenops.c
> @@ -181,11 +181,8 @@ _IO_wdefault_finish (FILE *fp, int dummy)
>    for (mark = fp->_markers; mark != NULL; mark = mark->_next)
>      mark->_sbuf = NULL;
>  
> -  if (fp->_IO_save_base)
> -    {
> -      free (fp->_wide_data->_IO_save_base);
> -      fp->_IO_save_base = NULL;
> -    }
> +  if (fp->_wide_data->_IO_save_base)
> +    _IO_free_wbackup_area (fp); 

_IO_have_wbackup, here.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."