Fix modification of string literal by swprintf

[Thomas Preudhomme]

Hi Corinna,

On 07/06/17 11:41, Thomas Preudhomme wrote:
> Hi Corinna,
>
> On 07/06/17 11:01, Corinna Vinschen wrote:
>> On Jun  5 09:59, Thomas Preudhomme wrote:
>>> Don't over-read memory returned by _DTOA_R, and never write to it
>>> since the result might be a string literal.
>>>
>>> For example, when doing:
>>>   swprintf(tt, 20, L"%.*f", 6, 0.0);
>>>
>>> we will get back "0".
>>>
>>> Instead, write the result returned by _DTOA_R to the output buffer.
>>> After this, write the 0 chars directly to the the output buffer
>>> (if there are any). This also has the (marginal) advantage that
>>> we read/write less memory overall.
>>>
>>> The patch, contributed by Silviu Baranga was tested against libcxx testsuite
>>> and showed no regression. Please find the patch in git format-patch format
>>> in attachment.
>>>
>>> Best regards,
>>>
>>> Thomas
>>
>>> >From 7a31cfb01a0b089daf2bed93b742b6edbf4cba0c Mon Sep 17 00:00:00 2001
>>> From: Silviu Baranga <silviu.baranga@arm.cm>
>>> Date: Mon, 5 Jun 2017 09:54:42 +0100
>>> Subject: [PATCH] Don't overread or write memory returned by _DTOA_R
>>>
>>> Don't over-read memory returned by _DTOA_R, and never write to it
>>> since the result might be a string literal.
>>>
>>> For example, when doing:
>>>   swprintf(tt, 20, L"%.*f", 6, 0.0);
>>>
>>> we will get back "0".
>>>
>>> Instead, write the result returned by _DTOA_R to the output buffer.
>>> After this, write the 0 chars directly to the the output buffer
>>> (if there are any). This also has the (marginal) advantage that
>>> we read/write less memory overall.
>>> ---
>>>  newlib/libc/locale/setlocale.h |  2 +-
>>>  newlib/libc/stdio/vfwprintf.c  | 24 ++++++++++++------------
>>>  2 files changed, 13 insertions(+), 13 deletions(-)
>>>
>>> diff --git a/newlib/libc/locale/setlocale.h b/newlib/libc/locale/setlocale.h
>>> index 85a38d5..1440d0e 100644
>>> --- a/newlib/libc/locale/setlocale.h
>>> +++ b/newlib/libc/locale/setlocale.h
>>> @@ -227,7 +227,7 @@ __get_locale_r (struct _reent *r)
>>>  _ELIDABLE_INLINE struct __locale_t *
>>>  __get_current_locale (void)
>>>  {
>>> -  return _REENT->_locale ?: __get_global_locale ();
>>> +  return _REENT->_locale ?: __get_global_locale (); // version for
>>> !_MB_CAPABLE?
>>>  }
>>
>> This doesn't belong here.  Also, the code is already fine for !_MB_CAPABLE
>> as well.
>
> My bad, this was a note I made to myself when reading on MB_CAPABLE some time
> ago. This does not belong to the patch and is indeed wrong.
>
>>
>>>  /* Only access fixed "C" locale using this function.  Fake for !_MB_CAPABLE
>>> diff --git a/newlib/libc/stdio/vfwprintf.c b/newlib/libc/stdio/vfwprintf.c
>>> index f0179a0..1bec9b2 100644
>>> --- a/newlib/libc/stdio/vfwprintf.c
>>> +++ b/newlib/libc/stdio/vfwprintf.c
>>> @@ -1627,13 +1627,20 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value,
>>> int ndigits, int flags,
>>>
>>>      {
>>>        char *digits, *bp, *rve;
>>> -#ifndef _MB_CAPABLE
>>>        int i;
>>> -#endif
>>>
>>>        digits = _DTOA_R (data, value, mode, ndigits, decpt, &dsgn, &rve);
>>>
>>> +#ifdef _MB_CAPABLE
>>> +      _mbsnrtowcs_r (data, buf, (const char **) &digits, rve - digits,
>>> +             len, NULL);
>>> +#else
>>> +      for (i = 0; i < rve - digits && i < len; ++i)
>>> +        buf[i] = (wchar_t) digits[i];
>>> +#endif
>>> +
>>>        if ((ch != L'g' && ch != L'G') || flags & ALT) {    /* Print trailing
>>> zeros */
>>> +        char *padding = rve;
>>>          bp = digits + ndigits;
>>>          if (ch == L'f' || ch == L'F') {
>>>              if (*digits == L'0' && value)
>>> @@ -1642,18 +1649,11 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value,
>>> int ndigits, int flags,
>>>          }
>>>          if (value == 0)    /* kludge for __dtoa irregularity */
>>>              rve = bp;
>>> -        while (rve < bp)
>>> -            *rve++ = '0';
>>> -      }
>>>
>>> +        for (i = padding - digits; i < rve - digits && i < len; ++i)
>>> +            buf[i] = L'0';
>>
>> Appending zeros here without incrementing rve...
>>
>>> +      }
>>>        *length = rve - digits; /* full length of the string */
>>
>> ...leads to incorrect setting of *length here.  Or am I missing
>> something?
>
> I'll transmit to Silviu for him to answer.

Please find his updated patch attached.

Best regards,

Thomas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Don-t-overread-or-write-memory-returned-by-_DTOA_R.patch
Type: text/x-patch
Size: 2174 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/newlib/attachments/20170608/d6dbc0d2/attachment.bin>