*sprintf bug (+patch)

[Jonathan Larmour]

When building GDB on current cygwin, the built GDB seg faults. After some 
investigation the reason is that recently the cygwin DLL has been 
exporting vasprintf from newlib, whereas previously it would use vasprintf 
from libiberty.

Some of the time this worked, but it just so happened that GDB, in a 
deterministic way would always seg fault in the same place. The reason was 
pretty coincidental: the _file member of a FILE pointing to the underlying 
fd was unset for the *sprintf family. Most of the times it was random 
memory. But in the failing case it was 0.

As a result isatty() of the fd succeeded since it was stdin (see 
libc/stdio/makebuf.c) and the FILE flags were set to be linebuffering, 
meaning that later in __sfvwrite() in libc/stdio/fvwrite.c, the wrong 
branch was taken and the code that does a special case check of the __SSTR 
flag was never hit. Instead it tried to access fp->_write, which for 
*sprintf was always set to 0, hence the seg fault.

The attached patch fixes this. I have checkin access to /cvs/src so can 
just check it straight in if that's easier.

Jifl

2003-02-04  Jonathan Larmour  <jifl@eCosCentric.com>

	* libc/stdio/vsprintf.c (vsprintf, _vsprintf_r): Set _file fd to
	-1 to be sure it cannot later match a valid file fd causing
	isatty() to return 1.
	* libc/stdio/asprintf.c (asprintf, _asprintf_r): Ditto.
	* libc/stdio/sprintf.c (sprintf, _sprintf_r): Ditto.
	* libc/stdio/vasprintf.c (vasprintf, _vasprintf_r): Ditto.

-- 
eCosCentric       http://www.eCosCentric.com/       <info@eCosCentric.com>
--[ "You can complain because roses have thorns, or you ]--
--[  can rejoice because thorns have roses." -Lincoln   ]-- Opinions==mine
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: newlib.sprintf.pat
URL: <http://sourceware.org/pipermail/newlib/attachments/20030204/cfe9ec46/attachment.ksh>