[PATCH v2] libio: validate the wide vtable via a bounds-checked index

[Avinal Kumar]

On Mon, Aug 24, 2026 at 10:27 PM Alessandro Schino
<7991aleschino@gmail.com> wrote:
>
> +/* Resolve a stored wide vtable index to its jump table, bounds-checked.  */
> +static inline const struct _IO_jump_t *
> +WIO_validate_index (unsigned int index)
> +{
> +  if (__glibc_unlikely (index >= IO_VTABLES_NUM))
> +    _IO_vtable_check ();

In cases where _IO_vtable_check() returns without aborting, like
IO_accept_foreign_vtables is set, the index can be out-of-range, which
may result in UB. There can be other cases too where the function just
returned cleanly. My question is, is this scenario not possible in the
current case?

> +  return &__io_vtables[index];
> +}
> +
> +/* Convert a wide vtable pointer (which must point at the start of a table
> +   inside __io_vtables) to its index for storage.  */
> +static inline unsigned int
> +WIO_vtable_to_index (const struct _IO_jump_t *vtable)
> +{
> +  uintptr_t offset = (uintptr_t) vtable - (uintptr_t) &__io_vtables;
> +  /* The pointer must be aligned to the start of a jump table and lie
> +     within the section; otherwise the stored index would be bogus.  */
> +  if (__glibc_unlikely (offset >= IO_VTABLES_LEN
> +                       || offset % sizeof (struct _IO_jump_t) != 0))
> +    _IO_vtable_check ();

Same doubt as above.

> +  return offset / sizeof (struct _IO_jump_t);
> +}
> +#endif /* IS_IN (libc) */
> +

If the scenario described above is possible, we will need to add a
test to check the fallthrough condition. The rest looks good to me.

One small nitpick, new additions uses WIO_ prefix, it would be
preferable to have something similar to IO_wide_* to maintain naming
consistency.

Thanks
- Avinal