Fix crash in _IO_wfile_sync (bug 20568)

When computing the length of the converted part of the stdio buffer, use
the number of consumed wide characters, not the (negative) distance to the
end of the wide buffer.

diff --git a/ChangeLog b/ChangeLog
index c01a2fdc514abac5e066125cb94e7836e51035d3..ce2b74938e1580185e31769de6dfa014692f4f72 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2019-05-15  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #20568]
+       * libio/wfileops.c (_IO_wfile_sync): Correct last argument to
+       __codecvt_do_length.
+       * libio/Makefile (tests): Add tst-wfile-sync.
+       ($(objpfx)tst-wfile-sync.out): Depend on $(gen-locales).
+       * libio/tst-wfile-sync.c: New file.
+       * libio/tst-wfile-sync.input: New file.
+
 2019-05-15  Florian Weimer  <fweimer@redhat.com>
 
        nss: Turn __nss_database_lookup into a compatibility symbol.
@@ -26,6 +36,7 @@
        * sysdeps/posix/getaddrinfo.c (gaih_inet): Likewise.
 
 2019-05-15  Alexandra Hajkova  <ahajkova@redhat.com>
+
        * support/support.h (support_install_rootsbindir): New variable.
        * support/support_paths.c: Likewise.
        * support/Makefile (CFLAGS-support_paths.c): Add -DROOTSBINDIR_PATH.

diff --git a/libio/Makefile b/libio/Makefile
index 95b91084ddd52a7a0c365383a446e3376a5d2c42..a5236c7042ac1b533d4d81adb252441e83c30e98 100644 (file)
--- a/libio/Makefile
+++ b/libio/Makefile
@@ -65,7 +65,8 @@ tests = tst_swprintf tst_wprintf tst_swscanf tst_wscanf tst_getwc tst_putwc   \
        tst-setvbuf1 tst-popen1 tst-fgetwc bug-wsetpos tst-fseek \
        tst-fwrite-error tst-ftell-partial-wide tst-ftell-active-handler \
        tst-ftell-append tst-fputws tst-bz22415 tst-fgetc-after-eof \
-       tst-sprintf-ub tst-sprintf-chk-ub tst-bz24051 tst-bz24153
+       tst-sprintf-ub tst-sprintf-chk-ub tst-bz24051 tst-bz24153 \
+       tst-wfile-sync
 
 tests-internal = tst-vtables tst-vtables-interposed tst-readline
 
@@ -212,6 +213,7 @@ $(objpfx)tst-ungetwc1.out: $(gen-locales)
 $(objpfx)tst-ungetwc2.out: $(gen-locales)
 $(objpfx)tst-widetext.out: $(gen-locales)
 $(objpfx)tst_wprintf2.out: $(gen-locales)
+$(objpfx)tst-wfile-sync.out: $(gen-locales)
 endif
 
 $(objpfx)test-freopen.out: test-freopen.sh $(objpfx)test-freopen

diff --git a/libio/tst-wfile-sync.c b/libio/tst-wfile-sync.c
new file mode 100644 (file)
index 0000000..6186820
--- /dev/null
+++ b/libio/tst-wfile-sync.c
@@ -0,0 +1,39 @@
+/* Test that _IO_wfile_sync does not crash (bug 20568).
+   Copyright (C) 2019 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <locale.h>
+#include <stdio.h>
+#include <wchar.h>
+#include <support/check.h>
+#include <support/xunistd.h>
+
+static int
+do_test (void)
+{
+  TEST_VERIFY_EXIT (setlocale (LC_ALL, "de_DE.UTF-8") != NULL);
+  /* Fill the stdio buffer and advance the read pointer.  */
+  TEST_VERIFY_EXIT (fgetwc (stdin) != WEOF);
+  /* This calls _IO_wfile_sync, it should not crash.  */
+  TEST_VERIFY_EXIT (setvbuf (stdin, NULL, _IONBF, 0) == 0);
+  /* Verify that the external file offset has been synchronized.  */
+  TEST_COMPARE (xlseek (0, 0, SEEK_CUR), 1);
+
+  return 0;
+}
+
+#include <support/test-driver.c>

diff --git a/libio/tst-wfile-sync.input b/libio/tst-wfile-sync.input
new file mode 100644 (file)
index 0000000..12d0958
--- /dev/null
+++ b/libio/tst-wfile-sync.input
@@ -0,0 +1 @@
+This is a test of _IO_wfile_sync.

diff --git a/libio/wfileops.c b/libio/wfileops.c
index 03676437035b15e51dcf88c19ac24f83f308caab..69fbb62a02c4d91bc0a9076f4ed0f774a7d027c2 100644 (file)
--- a/libio/wfileops.c
+++ b/libio/wfileops.c
@@ -508,11 +508,12 @@ _IO_wfile_sync (FILE *fp)
             generate the wide characters up to the current reading
             position.  */
          int nread;
-
+         size_t wnread = (fp->_wide_data->_IO_read_ptr
+                          - fp->_wide_data->_IO_read_base);
          fp->_wide_data->_IO_state = fp->_wide_data->_IO_last_state;
          nread = (*cv->__codecvt_do_length) (cv, &fp->_wide_data->_IO_state,
                                              fp->_IO_read_base,
-                                             fp->_IO_read_end, delta);
+                                             fp->_IO_read_end, wnread);
          fp->_IO_read_ptr = fp->_IO_read_base + nread;
          delta = -(fp->_IO_read_end - fp->_IO_read_base - nread);
        }