[PATCH v2] libio: validate the wide vtable via a bounds-checked index

[Avinal Kumar]

On Tue, Sep 8, 2026 at 1:47 PM Alessandro Schino
<7991aleschino@gmail.com> wrote:
>
> Looking at the wide path, my understanding is that this scenario cannot
> legitimately occur there: the wide vtable is only ever set to an
> internal table (&_IO_wfile_jumps and friends), and the foreign-vtable
> acceptance handled by _IO_vtable_check applies to the narrow vtable of
> the standard streams (see check_stdfiles_vtables), not to the wide
> dispatch. If that reading is correct, an out-of-range index on this
> path is always a genuine error rather than a legitimate foreign vtable.
>

I think your analysis is correct, the scenario is not practically reachable.

> If so, one option would be to terminate directly with __libc_fatal,
> which is noreturn, so a bad index can never reach the array access. I'd
> also rename the helpers to IO_wide_* for consistency as you suggested.
>
> Does that approach sound reasonable, or is there a wide-path case I'm
> missing where a foreign vtable could legitimately be in use?
>

IMO, you covered all the scenarios. Using __libc_fatal seems like a
good call, this makes the intention clearer, and we get compiler
advantage too.

Thanks
- Avinal