Fix crash in _IO_wfile_sync (bug 20568)

When computing the length of the converted part of the stdio buffer, use
the number of consumed wide characters, not the (negative) distance to the
end of the wide buffer.

(cherry picked from commit 32ff397533715988c19cbf3675dcbd727ec13e18)

diff --git a/ChangeLog b/ChangeLog
index c9448acfdd07bb1e1618c4712811c69b732092b4..ce563e00eeae4f469b536498f671d00ec92e2c22 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2019-05-15  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #20568]
+       * libio/wfileops.c (_IO_wfile_sync): Correct last argument to
+       __codecvt_do_length.
+       * libio/Makefile (tests): Add tst-wfile-sync.
+       ($(objpfx)tst-wfile-sync.out): Depend on $(gen-locales).
+       * libio/tst-wfile-sync.c: New file.
+       * libio/tst-wfile-sync.input: New file.
+
 2018-12-21  Istvan Kurucsai <pistukem@gmail.com>
 
        * malloc/malloc.c (munmap_chunk): Verify chunk alignment.

diff --git a/NEWS b/NEWS
index 9c2c37652f2319d357c723f1ac0227ca11063b2c..1da958d356c5dac2a0db04b4d84f57295a1799f7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,7 @@ The following bugs are resolved with this release:
   [19444] build failures with -O1 due to -Wmaybe-uninitialized
   [20018] getaddrinfo should reject IP addresses with trailing characters
   [20209] localedata: Spelling mistake for Sunday in Greenlandic kl_GL
+  [20568] Fix crash in _IO_wfile_sync
   [22927] libanl: properly cleanup if first helper thread creation failed
   [23400] stdlib/test-bz22786.c creates temporary files in glibc source tree
   [23497] readdir64@GLIBC_2.1 cannot parse the kernel directory stream

diff --git a/libio/Makefile b/libio/Makefile
index cab0eae946b1f307c9df6726330101bd41051243..cbfaf3832a45fc229eb81562506ffd7ef53aec4b 100644 (file)
--- a/libio/Makefile
+++ b/libio/Makefile
@@ -64,7 +64,8 @@ tests = tst_swprintf tst_wprintf tst_swscanf tst_wscanf tst_getwc tst_putwc   \
        bug-memstream1 bug-wmemstream1 \
        tst-setvbuf1 tst-popen1 tst-fgetwc bug-wsetpos tst-fseek \
        tst-fwrite-error tst-ftell-partial-wide tst-ftell-active-handler \
-       tst-ftell-append tst-fputws tst-bz22415 tst-fgetc-after-eof
+       tst-ftell-append tst-fputws tst-bz22415 tst-fgetc-after-eof \
+       tst-wfile-sync
 
 tests-internal = tst-vtables tst-vtables-interposed tst-readline
 
@@ -207,6 +208,7 @@ $(objpfx)tst-ungetwc1.out: $(gen-locales)
 $(objpfx)tst-ungetwc2.out: $(gen-locales)
 $(objpfx)tst-widetext.out: $(gen-locales)
 $(objpfx)tst_wprintf2.out: $(gen-locales)
+$(objpfx)tst-wfile-sync.out: $(gen-locales)
 endif
 
 $(objpfx)test-freopen.out: test-freopen.sh $(objpfx)test-freopen

diff --git a/libio/tst-wfile-sync.c b/libio/tst-wfile-sync.c
new file mode 100644 (file)
index 0000000..6186820
--- /dev/null
+++ b/libio/tst-wfile-sync.c
@@ -0,0 +1,39 @@
+/* Test that _IO_wfile_sync does not crash (bug 20568).
+   Copyright (C) 2019 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <locale.h>
+#include <stdio.h>
+#include <wchar.h>
+#include <support/check.h>
+#include <support/xunistd.h>
+
+static int
+do_test (void)
+{
+  TEST_VERIFY_EXIT (setlocale (LC_ALL, "de_DE.UTF-8") != NULL);
+  /* Fill the stdio buffer and advance the read pointer.  */
+  TEST_VERIFY_EXIT (fgetwc (stdin) != WEOF);
+  /* This calls _IO_wfile_sync, it should not crash.  */
+  TEST_VERIFY_EXIT (setvbuf (stdin, NULL, _IONBF, 0) == 0);
+  /* Verify that the external file offset has been synchronized.  */
+  TEST_COMPARE (xlseek (0, 0, SEEK_CUR), 1);
+
+  return 0;
+}
+
+#include <support/test-driver.c>

diff --git a/libio/tst-wfile-sync.input b/libio/tst-wfile-sync.input
new file mode 100644 (file)
index 0000000..12d0958
--- /dev/null
+++ b/libio/tst-wfile-sync.input
@@ -0,0 +1 @@
+This is a test of _IO_wfile_sync.

diff --git a/libio/wfileops.c b/libio/wfileops.c
index 63cb687652c72ce182b4b9e0c8bb3963459ae182..10e7343f8fdb8781e46be7f3ec14356991f62072 100644 (file)
--- a/libio/wfileops.c
+++ b/libio/wfileops.c
@@ -508,11 +508,12 @@ _IO_wfile_sync (FILE *fp)
             generate the wide characters up to the current reading
             position.  */
          int nread;
-
+         size_t wnread = (fp->_wide_data->_IO_read_ptr
+                          - fp->_wide_data->_IO_read_base);
          fp->_wide_data->_IO_state = fp->_wide_data->_IO_last_state;
          nread = (*cv->__codecvt_do_length) (cv, &fp->_wide_data->_IO_state,
                                              fp->_IO_read_base,
-                                             fp->_IO_read_end, delta);
+                                             fp->_IO_read_end, wnread);
          fp->_IO_read_ptr = fp->_IO_read_base + nread;
          delta = -(fp->_IO_read_end - fp->_IO_read_base - nread);
        }