[PATCH v2] Prevent use of uninitialized file lock

Sebastian Huber sebastian.huber@embedded-brains.de
Wed Jul 1 20:04:00 GMT 2015


The CHECK_INIT() is necessary before the _newlib_flockfile_start() since
this would use otherwise acquire an uninitialized lock which gets
initialized after this leading to a corrupt release.

newlib/ChangeLog
2015-07-01  Sebastian Huber  <sebastian.huber@embedded-brains.de>

	libc/stdio/fputs.c (_puts_r): Add missing CHECK_INIT().
	libc/stdio/gets.c (_gets_r): Add missing
	_REENT_SMALL_CHECK_INIT() and CHECK_INIT().  Use _stdin_r() to
	get the file pointer instead of stdin.
---
 newlib/libc/stdio/gets.c | 12 ++++++++----
 newlib/libc/stdio/puts.c |  2 ++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/newlib/libc/stdio/gets.c b/newlib/libc/stdio/gets.c
index f51d461..6c21f3e 100644
--- a/newlib/libc/stdio/gets.c
+++ b/newlib/libc/stdio/gets.c
@@ -79,13 +79,17 @@ _DEFUN(_gets_r, (ptr, buf),
 {
   register int c;
   register char *s = buf;
+  FILE *fp;
 
-  _newlib_flockfile_start (stdin);
-  while ((c = __sgetc_r (ptr, stdin)) != '\n')
+  _REENT_SMALL_CHECK_INIT (ptr);
+  fp = _stdin_r (ptr);
+  CHECK_INIT (ptr, fp);
+  _newlib_flockfile_start (fp);
+  while ((c = __sgetc_r (ptr, fp)) != '\n')
     if (c == EOF)
       if (s == buf)
 	{
-	  _newlib_flockfile_exit (stdin);
+	  _newlib_flockfile_exit (fp);
 	  return NULL;
 	}
       else
@@ -93,7 +97,7 @@ _DEFUN(_gets_r, (ptr, buf),
     else
       *s++ = c;
   *s = 0;
-  _newlib_flockfile_end (stdin);
+  _newlib_flockfile_end (fp);
   return buf;
 }
 
diff --git a/newlib/libc/stdio/puts.c b/newlib/libc/stdio/puts.c
index 4c60aaa..7467371 100644
--- a/newlib/libc/stdio/puts.c
+++ b/newlib/libc/stdio/puts.c
@@ -95,6 +95,7 @@ _DEFUN(_puts_r, (ptr, s),
 
   _REENT_SMALL_CHECK_INIT (ptr);
   fp = _stdout_r (ptr);
+  CHECK_INIT (ptr, fp);
   _newlib_flockfile_start (fp);
   ORIENT (fp, -1);
   result = (__sfvwrite_r (ptr, fp, &uio) ? EOF : '\n');
@@ -107,6 +108,7 @@ _DEFUN(_puts_r, (ptr, s),
   _REENT_SMALL_CHECK_INIT (ptr);
 
   fp = _stdout_r (ptr);
+  CHECK_INIT (ptr, fp);
   _newlib_flockfile_start (fp);
   ORIENT (fp, -1);
   /* Make sure we can write.  */
-- 
1.8.4.5



More information about the Newlib mailing list