diff mbox series

Fix aliasing violation in __vfscanf_internal [BZ #26690]

Message ID 20201007175049.32564-1-szabolcs.nagy@arm.com
State Dropped
Headers
Series Fix aliasing violation in __vfscanf_internal [BZ #26690] |

Commit Message

Szabolcs Nagy Oct. 7, 2020, 5:50 p.m. UTC 
  Internal stdio code uses both CHAR_T and UCHAR_T strings.
But the internal helper read_int was only written for UCHAR_T.

A CHAR_T object can alias UCHAR_T, but CHAR_T * cannot alias
UCHAR_T *.  This means a cast like (UCHAR_T **)&pc is likely
a bug in the code (currently GCC does not warn about this
see PR97321). The fix introduces a read_int_char variant and
removes the problematic casts.

(The mixed use of CHAR_T and UCHAR_T may be a design mistake
in stdio: if everything used char and wchar_t consistently
then aliasing violation would be much less likely, but fixing
that requires more refactoring.)

Fixes bug 26690.
---
 stdio-common/vfscanf-internal.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

Comments

Florian Weimer Oct. 7, 2020, 6:08 p.m. UTC | #1 
* Szabolcs Nagy via Libc-alpha:

> diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
> index 95b46dcbeb..d832493623 100644
> --- a/stdio-common/vfscanf-internal.c
> +++ b/stdio-common/vfscanf-internal.c
> @@ -135,6 +135,16 @@
>  
>  #include "printf-parse.h" /* Use read_int.  */
>  
> +/* Same as read_int, but for CHAR_T * instead of UCHAR_T * string.  */
> +static int
> +read_int_char (const CHAR_T * *pstr)
> +{
> +  const UCHAR_T *ustr = (const UCHAR_T *) *pstr;
> +  int retval = read_int (&ustr);
> +  *pstr = (const CHAR_T *) ustr;
> +  return retval;
> +}
> +
>  #define encode_error() do {						      \
>  			  __set_errno (EILSEQ);				      \
>  			  goto errout;					      \
> @@ -486,7 +496,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>        /* Check for a positional parameter specification.  */
>        if (ISDIGIT ((UCHAR_T) *f))
>  	{
> -	  argpos = read_int ((const UCHAR_T **) &f);
> +	  argpos = read_int_char (&f);
>  	  if (*f == L_('$'))
>  	    ++f;
>  	  else
> @@ -522,7 +532,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>        /* Find the maximum field width.  */
>        width = 0;
>        if (ISDIGIT ((UCHAR_T) *f))
> -	width = read_int ((const UCHAR_T **) &f);
> +	width = read_int_char (&f);
>      got_width:
>        if (width == 0)
>  	width = -1;

Patch and commit message look reasonable to me.  Thanks.
Adhemerval Zanella Netto Oct. 7, 2020, 6:10 p.m. UTC | #2 
On 07/10/2020 15:08, Florian Weimer wrote:
> * Szabolcs Nagy via Libc-alpha:
> 
>> diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
>> index 95b46dcbeb..d832493623 100644
>> --- a/stdio-common/vfscanf-internal.c
>> +++ b/stdio-common/vfscanf-internal.c
>> @@ -135,6 +135,16 @@
>>  
>>  #include "printf-parse.h" /* Use read_int.  */
>>  
>> +/* Same as read_int, but for CHAR_T * instead of UCHAR_T * string.  */
>> +static int
>> +read_int_char (const CHAR_T * *pstr)
>> +{
>> +  const UCHAR_T *ustr = (const UCHAR_T *) *pstr;
>> +  int retval = read_int (&ustr);
>> +  *pstr = (const CHAR_T *) ustr;
>> +  return retval;
>> +}
>> +
>>  #define encode_error() do {						      \
>>  			  __set_errno (EILSEQ);				      \
>>  			  goto errout;					      \
>> @@ -486,7 +496,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>>        /* Check for a positional parameter specification.  */
>>        if (ISDIGIT ((UCHAR_T) *f))
>>  	{
>> -	  argpos = read_int ((const UCHAR_T **) &f);
>> +	  argpos = read_int_char (&f);
>>  	  if (*f == L_('$'))
>>  	    ++f;
>>  	  else
>> @@ -522,7 +532,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>>        /* Find the maximum field width.  */
>>        width = 0;
>>        if (ISDIGIT ((UCHAR_T) *f))
>> -	width = read_int ((const UCHAR_T **) &f);
>> +	width = read_int_char (&f);
>>      got_width:
>>        if (width == 0)
>>  	width = -1;
> 
> Patch and commit message look reasonable to me.  Thanks.
> 

Andreas has sent a similar fix for the same issue [1]. Is it something
wrong with his fix? It seems to cover more aliasing violation 

[1] https://sourceware.org/pipermail/libc-alpha/2020-October/118149.html
Florian Weimer Oct. 7, 2020, 6:16 p.m. UTC | #3 
* Adhemerval Zanella:

> On 07/10/2020 15:08, Florian Weimer wrote:
>> * Szabolcs Nagy via Libc-alpha:
>> 
>>> diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
>>> index 95b46dcbeb..d832493623 100644
>>> --- a/stdio-common/vfscanf-internal.c
>>> +++ b/stdio-common/vfscanf-internal.c
>>> @@ -135,6 +135,16 @@
>>>  
>>>  #include "printf-parse.h" /* Use read_int.  */
>>>  
>>> +/* Same as read_int, but for CHAR_T * instead of UCHAR_T * string.  */
>>> +static int
>>> +read_int_char (const CHAR_T * *pstr)
>>> +{
>>> +  const UCHAR_T *ustr = (const UCHAR_T *) *pstr;
>>> +  int retval = read_int (&ustr);
>>> +  *pstr = (const CHAR_T *) ustr;
>>> +  return retval;
>>> +}
>>> +
>>>  #define encode_error() do {						      \
>>>  			  __set_errno (EILSEQ);				      \
>>>  			  goto errout;					      \
>>> @@ -486,7 +496,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>>>        /* Check for a positional parameter specification.  */
>>>        if (ISDIGIT ((UCHAR_T) *f))
>>>  	{
>>> -	  argpos = read_int ((const UCHAR_T **) &f);
>>> +	  argpos = read_int_char (&f);
>>>  	  if (*f == L_('$'))
>>>  	    ++f;
>>>  	  else
>>> @@ -522,7 +532,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>>>        /* Find the maximum field width.  */
>>>        width = 0;
>>>        if (ISDIGIT ((UCHAR_T) *f))
>>> -	width = read_int ((const UCHAR_T **) &f);
>>> +	width = read_int_char (&f);
>>>      got_width:
>>>        if (width == 0)
>>>  	width = -1;
>> 
>> Patch and commit message look reasonable to me.  Thanks.
>> 
>
> Andreas has sent a similar fix for the same issue [1]. Is it something
> wrong with his fix? It seems to cover more aliasing violation 
>
> [1] https://sourceware.org/pipermail/libc-alpha/2020-October/118149.html

The other patch looks reasonable to me as well, slightly better even.
I had missed it, sorry.

The additional changes are just shuffling harmless casts around, not
fixes for more aliasing violations, as far as I can see.
Szabolcs Nagy Oct. 8, 2020, 7:27 a.m. UTC | #4 
The 10/07/2020 20:16, Florian Weimer wrote:
> * Adhemerval Zanella:
> 
> > On 07/10/2020 15:08, Florian Weimer wrote:
> >> * Szabolcs Nagy via Libc-alpha:
> >> 
> >>> diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
> >>> index 95b46dcbeb..d832493623 100644
> >>> --- a/stdio-common/vfscanf-internal.c
> >>> +++ b/stdio-common/vfscanf-internal.c
> >>> @@ -135,6 +135,16 @@
> >>>  
> >>>  #include "printf-parse.h" /* Use read_int.  */
> >>>  
> >>> +/* Same as read_int, but for CHAR_T * instead of UCHAR_T * string.  */
> >>> +static int
> >>> +read_int_char (const CHAR_T * *pstr)
> >>> +{
> >>> +  const UCHAR_T *ustr = (const UCHAR_T *) *pstr;
> >>> +  int retval = read_int (&ustr);
> >>> +  *pstr = (const CHAR_T *) ustr;
> >>> +  return retval;
> >>> +}
> >>> +
> >>>  #define encode_error() do {						      \
> >>>  			  __set_errno (EILSEQ);				      \
> >>>  			  goto errout;					      \
> >>> @@ -486,7 +496,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
> >>>        /* Check for a positional parameter specification.  */
> >>>        if (ISDIGIT ((UCHAR_T) *f))
> >>>  	{
> >>> -	  argpos = read_int ((const UCHAR_T **) &f);
> >>> +	  argpos = read_int_char (&f);
> >>>  	  if (*f == L_('$'))
> >>>  	    ++f;
> >>>  	  else
> >>> @@ -522,7 +532,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
> >>>        /* Find the maximum field width.  */
> >>>        width = 0;
> >>>        if (ISDIGIT ((UCHAR_T) *f))
> >>> -	width = read_int ((const UCHAR_T **) &f);
> >>> +	width = read_int_char (&f);
> >>>      got_width:
> >>>        if (width == 0)
> >>>  	width = -1;
> >> 
> >> Patch and commit message look reasonable to me.  Thanks.
> >> 
> >
> > Andreas has sent a similar fix for the same issue [1]. Is it something
> > wrong with his fix? It seems to cover more aliasing violation 
> >
> > [1] https://sourceware.org/pipermail/libc-alpha/2020-October/118149.html
> 
> The other patch looks reasonable to me as well, slightly better even.
> I had missed it, sorry.

me too.

> 
> The additional changes are just shuffling harmless casts around, not
> fixes for more aliasing violations, as far as I can see.
diff mbox series

Patch

diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
index 95b46dcbeb..d832493623 100644
--- a/stdio-common/vfscanf-internal.c
+++ b/stdio-common/vfscanf-internal.c
@@ -135,6 +135,16 @@ 
 
 #include "printf-parse.h" /* Use read_int.  */
 
+/* Same as read_int, but for CHAR_T * instead of UCHAR_T * string.  */
+static int
+read_int_char (const CHAR_T * *pstr)
+{
+  const UCHAR_T *ustr = (const UCHAR_T *) *pstr;
+  int retval = read_int (&ustr);
+  *pstr = (const CHAR_T *) ustr;
+  return retval;
+}
+
 #define encode_error() do {						      \
 			  __set_errno (EILSEQ);				      \
 			  goto errout;					      \
@@ -486,7 +496,7 @@  __vfscanf_internal (FILE *s, const char *format, va_list argptr,
       /* Check for a positional parameter specification.  */
       if (ISDIGIT ((UCHAR_T) *f))
 	{
-	  argpos = read_int ((const UCHAR_T **) &f);
+	  argpos = read_int_char (&f);
 	  if (*f == L_('$'))
 	    ++f;
 	  else
@@ -522,7 +532,7 @@  __vfscanf_internal (FILE *s, const char *format, va_list argptr,
       /* Find the maximum field width.  */
       width = 0;
       if (ISDIGIT ((UCHAR_T) *f))
-	width = read_int ((const UCHAR_T **) &f);
+	width = read_int_char (&f);
     got_width:
       if (width == 0)
 	width = -1;