Fix crash in _IO_wfile_sync (bug 20568)

When computing the length of the converted part of the stdio buffer, use
the number of consumed wide characters, not the (negative) distance to the
end of the wide buffer.

(cherry picked from commit 32ff397533715988c19cbf3675dcbd727ec13e18)

diff --git a/ChangeLog b/ChangeLog
index b0afd11b081f4df26448395b007c5f46e9dcb27e..78924ef13e4ec0608c0e92d4d864a41c8e5b6911 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2019-05-15  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #20568]
+       * libio/wfileops.c (_IO_wfile_sync): Correct last argument to
+       __codecvt_do_length.
+       * libio/Makefile (tests): Add tst-wfile-sync.
+       ($(objpfx)tst-wfile-sync.out): Depend on $(gen-locales).
+       * libio/tst-wfile-sync.c: New file.
+       * libio/tst-wfile-sync.input: New file.
+
 2019-02-07  Stefan Liebler  <stli@linux.ibm.com>
 
        [BZ #24180]

diff --git a/NEWS b/NEWS
index 735c57872657d9a3c4a239254f18af09d9fe8094..c6c44a3914293fea198c1108bd565109da30f2de 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -107,6 +107,7 @@ The following bugs are resolved with this release:
   [17956] crypt: Use NSPR header files in addition to NSS header files
   [20419] elf: Fix stack overflow with huge PT_NOTE segment
   [20532] getaddrinfo: More robust handling of dlopen failures
+  [20568] Fix crash in _IO_wfile_sync
   [21242] assert: Suppress pedantic warning caused by statement expression
   [21265] x86-64: Use fxsave/xsave/xsavec in _dl_runtime_resolve
   [21269] i386 sigaction sa_restorer handling is wrong

diff --git a/libio/Makefile b/libio/Makefile
index 74bf5279f1a9bfc335dfb7e3f574b4657fb53970..79158f3ebd07d2dd4330eb06e001001fa8f41594 100644 (file)
--- a/libio/Makefile
+++ b/libio/Makefile
@@ -62,7 +62,7 @@ tests = tst_swprintf tst_wprintf tst_swscanf tst_wscanf tst_getwc tst_putwc   \
        bug-memstream1 bug-wmemstream1 \
        tst-setvbuf1 tst-popen1 tst-fgetwc bug-wsetpos tst-fseek \
        tst-fwrite-error tst-ftell-partial-wide tst-ftell-active-handler \
-       tst-ftell-append tst-fputws
+       tst-ftell-append tst-fputws tst-wfile-sync
 
 tests-internal = tst-vtables tst-vtables-interposed
 
@@ -202,6 +202,7 @@ $(objpfx)tst-ungetwc1.out: $(gen-locales)
 $(objpfx)tst-ungetwc2.out: $(gen-locales)
 $(objpfx)tst-widetext.out: $(gen-locales)
 $(objpfx)tst_wprintf2.out: $(gen-locales)
+$(objpfx)tst-wfile-sync.out: $(gen-locales)
 endif
 
 $(objpfx)test-freopen.out: test-freopen.sh $(objpfx)test-freopen

diff --git a/libio/tst-wfile-sync.c b/libio/tst-wfile-sync.c
new file mode 100644 (file)
index 0000000..6186820
--- /dev/null
+++ b/libio/tst-wfile-sync.c
@@ -0,0 +1,39 @@
+/* Test that _IO_wfile_sync does not crash (bug 20568).
+   Copyright (C) 2019 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <locale.h>
+#include <stdio.h>
+#include <wchar.h>
+#include <support/check.h>
+#include <support/xunistd.h>
+
+static int
+do_test (void)
+{
+  TEST_VERIFY_EXIT (setlocale (LC_ALL, "de_DE.UTF-8") != NULL);
+  /* Fill the stdio buffer and advance the read pointer.  */
+  TEST_VERIFY_EXIT (fgetwc (stdin) != WEOF);
+  /* This calls _IO_wfile_sync, it should not crash.  */
+  TEST_VERIFY_EXIT (setvbuf (stdin, NULL, _IONBF, 0) == 0);
+  /* Verify that the external file offset has been synchronized.  */
+  TEST_COMPARE (xlseek (0, 0, SEEK_CUR), 1);
+
+  return 0;
+}
+
+#include <support/test-driver.c>

diff --git a/libio/tst-wfile-sync.input b/libio/tst-wfile-sync.input
new file mode 100644 (file)
index 0000000..12d0958
--- /dev/null
+++ b/libio/tst-wfile-sync.input
@@ -0,0 +1 @@
+This is a test of _IO_wfile_sync.

diff --git a/libio/wfileops.c b/libio/wfileops.c
index fb94f45040f57f36c3fc6c98b699ef6f7f2b4c01..727e1b23b92fced4debf26d7df3f619ffe3402f5 100644 (file)
--- a/libio/wfileops.c
+++ b/libio/wfileops.c
@@ -526,11 +526,12 @@ _IO_wfile_sync (_IO_FILE *fp)
             generate the wide characters up to the current reading
             position.  */
          int nread;
-
+         size_t wnread = (fp->_wide_data->_IO_read_ptr
+                          - fp->_wide_data->_IO_read_base);
          fp->_wide_data->_IO_state = fp->_wide_data->_IO_last_state;
          nread = (*cv->__codecvt_do_length) (cv, &fp->_wide_data->_IO_state,
                                              fp->_IO_read_base,
-                                             fp->_IO_read_end, delta);
+                                             fp->_IO_read_end, wnread);
          fp->_IO_read_ptr = fp->_IO_read_base + nread;
          delta = -(fp->_IO_read_end - fp->_IO_read_base - nread);
        }