From: Petr Baudis <pasky@suse.cz>
Date: Sun, 20 Feb 2011 12:59:49 +0000 (+0100)
Subject: Fix allocation when handling positional parameters in printf.
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a4fd88c0fcf4e51825a540820bc9a95081f4f9fb;p=thirdparty%2Fglibc.git

Fix allocation when handling positional parameters in printf.

(cherry picked from commit 84a4211850e3d23a9d3a4f3b294752a3b30bc0ff)
---

diff --git a/ChangeLog b/ChangeLog
index 17c436dffe9..25c8e7ee20d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2011-01-27  Petr Baudis  <pasky@suse.cz>
+	    Ulrich Drepper  <drepper@gmail.com>
+
+	[BZ #12445]
+	* stdio-common/vfprintf.c (vfprintf): Pass correct newlen
+	to extend_alloca().
+	* stdio-common/bug23.c: New file.
+	* stdio-common/Makefile (tests): Add bug23.
+
 2011-02-16  Ryan S. Arnold  <rsa@us.ibm.com>
 
 	* sysdeps/unix/sysv/linux/powerpc/powerpc64/sysdep.h:
diff --git a/stdio-common/Makefile b/stdio-common/Makefile
index 6aabfb6b545..6c71f1c37f5 100644
--- a/stdio-common/Makefile
+++ b/stdio-common/Makefile
@@ -60,7 +60,7 @@ tests := tstscanf test_rdwr test-popen tstgetln test-fseek \
 	 tst-popen tst-unlockedio tst-fmemopen2 tst-put-error tst-fgets \
 	 tst-fwrite bug16 bug17 tst-swscanf tst-sprintf2 bug18 bug18a \
 	 bug19 bug19a tst-popen2 scanf13 scanf14 scanf15 bug20 bug21 bug22 \
-	 scanf16 scanf17 tst-setvbuf1 tst-grouping
+	 scanf16 scanf17 tst-setvbuf1 tst-grouping bug23
 
 test-srcs = tst-unbputc tst-printf
 
diff --git a/stdio-common/bug23.c b/stdio-common/bug23.c
new file mode 100644
index 00000000000..dcc5428078a
--- /dev/null
+++ b/stdio-common/bug23.c
@@ -0,0 +1,21 @@
+#include <stdio.h>
+#include <string.h>
+
+static char buf[32768];
+static const char expected[] = "\
+\n\
+a\n\
+abbcd55%%%%%%%%%%%%%%%%%%%%%%%%%%\n";
+
+static int
+do_test (void)
+{
+  snprintf (buf, sizeof (buf),
+	    "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+	    "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n",
+	    "a", "b", "c", "d", 5);
+  return strcmp (buf, expected) != 0;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index 6e0e85cd7cc..ab7fa1371fc 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1991-2008, 2009   Free Software Foundation, Inc.
+/* Copyright (C) 1991-2008, 2009, 2011   Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -1676,7 +1676,8 @@ do_positional:
 	  {
 	    /* Extend the array of format specifiers.  */
 	    struct printf_spec *old = specs;
-	    specs = extend_alloca (specs, nspecs_max, 2 * nspecs_max);
+	    specs = extend_alloca (specs, nspecs_max,
+				   2 * nspecs_max * sizeof (*specs));
 
 	    /* Copy the old array's elements to the new space.  */
 	    memmove (specs, old, nspecs * sizeof (struct printf_spec));