From: Carlos O'Donell <carlos@redhat.com>
Date: Thu, 30 Jan 2014 18:19:58 +0000 (-0500)
Subject: Don't parse %s format argument as multibyte string
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7def6a63a0298d2e5275820db22eb40ac3dcbe4b;p=thirdparty%2Fglibc.git

Don't parse %s format argument as multibyte string

2012-09-28  Andreas Schwab  <schwab@linux-m68k.org>

            [BZ #6530]
            * stdio-common/vfprintf.c (process_string_arg): Revert
            2000-07-22 change.

2011-09-28  Jonathan Nieder  <jrnieder@gmail.com>

            * stdio-common/Makefile (tst-sprintf-ENV): Set environment
            for testcase.
            * stdio-common/tst-sprintf.c: Include <locale.h>
            (main): Test sprintf's handling of incomplete multibyte
            characters.

(cherry picked from commit 715a900c9085907fa749589bf738b192b1a2bda5)
---

diff --git a/ChangeLog b/ChangeLog
index 82d343df4df..7b5442d7418 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,17 @@
+2012-09-28  Andreas Schwab  <schwab@linux-m68k.org>
+
+	[BZ #6530]
+	* stdio-common/vfprintf.c (process_string_arg): Revert
+	2000-07-22 change.
+
+2011-09-28  Jonathan Nieder  <jrnieder@gmail.com>
+
+	* stdio-common/Makefile (tst-sprintf-ENV): Set environment
+	for testcase.
+	* stdio-common/tst-sprintf.c: Include <locale.h>
+	(main): Test sprintf's handling of incomplete multibyte
+	characters.
+
 2012-06-22  Andreas Schwab  <schwab@redhat.com>
 
 	[BZ #13579]
diff --git a/NEWS b/NEWS
index 1abe378f179..8f8ff325e3b 100644
--- a/NEWS
+++ b/NEWS
@@ -9,10 +9,10 @@ Version 2.15.1
 
 * The following bugs are resolved with this release:
 
-  411, 2547, 2548, 11261, 11365, 11494, 13583, 13618, 13731, 13732, 13733,
-  13747, 13748, 13749, 13753, 13754, 13756, 13765, 13771, 13773, 13774,
-  13786, 14048, 14059, 14167, 14273, 14284, 14459, 14621, 14648, 14040,
-  15073
+  411, 2547, 2548, 6530, 11261, 11365, 11494, 13583, 13618, 13731, 13732,
+  13733, 13747, 13748, 13749, 13753, 13754, 13756, 13765, 13771, 13773,
+  13774, 13786, 14048, 14059, 14167, 14273, 14284, 14459, 14621, 14648,
+  14040, 15073
 
 Version 2.15
 
diff --git a/stdio-common/Makefile b/stdio-common/Makefile
index 006f546893e..62dda0b7951 100644
--- a/stdio-common/Makefile
+++ b/stdio-common/Makefile
@@ -122,6 +122,7 @@ CFLAGS-scanf17.c = -I../libio -I../stdlib -I../wcsmbs -I../time -I../string \
 
 # We know the test has a format string problem.
 CFLAGS-tst-sprintf.c = -Wno-format
+tst-sprintf-ENV = LOCPATH=$(common-objpfx)localedata
 tst-sscanf-ENV = LOCPATH=$(common-objpfx)localedata
 tst-swprintf-ENV = LOCPATH=$(common-objpfx)localedata
 test-vfprintf-ENV = LOCPATH=$(common-objpfx)localedata
diff --git a/stdio-common/tst-sprintf.c b/stdio-common/tst-sprintf.c
index c04fef18f4b..c4e911fe94d 100644
--- a/stdio-common/tst-sprintf.c
+++ b/stdio-common/tst-sprintf.c
@@ -1,5 +1,6 @@
 #include <stdio.h>
 #include <stdlib.h>
+#include <locale.h>
 #include <string.h>
 
 
@@ -58,5 +59,17 @@ main (void)
       result = 1;
     }
 
+  if (setlocale (LC_ALL, "de_DE.UTF-8") == NULL)
+    {
+      puts ("cannot set locale");
+      result = 1;
+    }
+  else if (sprintf (buf, "%.8s\n", "Foo: \277") != 7
+	   || strcmp (buf, "Foo: \277\n") != 0)
+    {
+      printf ("sprintf (buf, \"%%.8s\\n\", \"Foo: \\277\") produced '%s' output\n", buf);
+      result = 1;
+    }
+
   return result;
 }
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index 952886b69e7..fd5f5515f6c 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1161,41 +1161,9 @@ vfprintf (FILE *s, const CHAR_T *format, va_list ap)
 	else if (!is_long && spec != L_('S'))				      \
 	  {								      \
 	    if (prec != -1)						      \
-	      {								      \
-		/* Search for the end of the string, but don't search past    \
-		   the length (in bytes) specified by the precision.  Also    \
-		   don't use incomplete characters.  */			      \
-		if (_NL_CURRENT_WORD (LC_CTYPE, _NL_CTYPE_MB_CUR_MAX) == 1)   \
-		  len = __strnlen (string, prec);			      \
-		else							      \
-		  {							      \
-		    /* In case we have a multibyte character set the	      \
-		       situation is more complicated.  We must not copy	      \
-		       bytes at the end which form an incomplete character. */\
-		    size_t ignore_size = (unsigned) prec > 1024 ? 1024 : prec;\
-		    wchar_t ignore[ignore_size];			      \
-		    const char *str2 = string;				      \
-		    const char *strend = string + prec;			      \
-		    if (strend < string)				      \
-		      strend = (const char *) UINTPTR_MAX;		      \
-									      \
-		    mbstate_t ps;					      \
-		    memset (&ps, '\0', sizeof (ps));			      \
-									      \
-		    while (str2 != NULL && str2 < strend)		      \
-		      if (__mbsnrtowcs (ignore, &str2, strend - str2,	      \
-					ignore_size, &ps) == (size_t) -1)     \
-			{						      \
-			  done = -1;					      \
-			  goto all_done;				      \
-			}						      \
-									      \
-		    if (str2 == NULL)					      \
-		      len = strlen (string);				      \
-		    else						      \
-		      len = str2 - string - (ps.__count & 7);		      \
-		  }							      \
-	      }								      \
+	      /* Search for the end of the string, but don't search past      \
+		 the length (in bytes) specified by the precision.  */	      \
+	      len = __strnlen (string, prec);				      \
 	    else							      \
 	      len = strlen (string);					      \
 	  }								      \