From patchwork Tue Sep 26 03:41:47 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Takashi Yano X-Patchwork-Id: 76673 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 1DFEE3857BB3 for ; Tue, 26 Sep 2023 03:42:02 +0000 (GMT) X-Original-To: newlib@sourceware.org Delivered-To: newlib@sourceware.org Received: from dmta0002.nifty.com (mta-snd00007.nifty.com [106.153.226.39]) by sourceware.org (Postfix) with ESMTPS id C94C43858D35 for ; Tue, 26 Sep 2023 03:41:48 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org C94C43858D35 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=nifty.ne.jp Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=nifty.ne.jp Received: from HP-Z230 by dmta0002.nifty.com with ESMTP id <20230926034146610.WMFV.56322.HP-Z230@nifty.com> for ; Tue, 26 Sep 2023 12:41:46 +0900 Date: Tue, 26 Sep 2023 12:41:47 +0900 From: Takashi Yano To: newlib@sourceware.org Subject: fprintf() crashes on wide-oriented stream. Message-Id: <20230926124147.a4dd18b495c6e0347a64fec0@nifty.ne.jp> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.30; i686-pc-mingw32) Mime-Version: 1.0 X-Spam-Status: No, score=-9.8 required=5.0 tests=BAYES_00, GIT_PATCH_0, KAM_DMARC_STATUS, RCVD_IN_DNSWL_NONE, SPF_HELO_PASS, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: newlib@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Newlib mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: newlib-bounces+patchwork=sourceware.org@sourceware.org Sender: "Newlib" Hi, I noticed that the following test case crashes at printf() with current newlib. #include #include #include int main() { setlocale(LC_ALL, "C.UTF-8"); wprintf(L"%ls\n", L"aaaa"); /* or fwide(stdout, 1); */ printf("%ls\n", L"bbbb"); /* <--- crash here */ return 0; } I looked into this problem and found the cause. A narrow char string which can be odd bytes in length is cast into a wide char string which should be even bytes in length in __sprint_r/ __sfputs_r based on the __SWID flag. As a result, if the length is odd bytes, the reading buffer runs over the buffer length, which causes a crash. If the length is even bytes, crash does not happen, but garbage is printed. This hapens if printf("%ls\r\n", L"bbbb"); is used instead. ^^ The same issue seemed to be reported ten years ago. https://sourceware.org/pipermail/newlib/2013/010831.html I have built a patch attached for this issue. With this patch, __sfputs_r/__sprint_r is split into two versions, one is for vfprintf which does not handle wide string, and the other (newly introduced __sfputws_r/__swprin_r) is for vfwprintf which handles wide string. Please note that fprintf gets working for wide orient stream just like BSD libc, which behaves differently from GNU libc. This patch also fixes nano-vfprintf.c as well as vfprintf.c/vfwprintf.c in the same manner. Could someone please review the patch? Thanks in advance. diff --git a/newlib/libc/stdio/nano-vfprintf.c b/newlib/libc/stdio/nano-vfprintf.c index 0d42a940f..d2143ef08 100644 --- a/newlib/libc/stdio/nano-vfprintf.c +++ b/newlib/libc/stdio/nano-vfprintf.c @@ -356,32 +356,7 @@ __sprint_r (struct _reent *ptr, uio->uio_iovcnt = 0; return 0; } -#if defined _WIDE_ORIENT && (!defined _ELIX_LEVEL || _ELIX_LEVEL >= 4) - if (fp->_flags2 & __SWID) - { - struct __siov *iov; - wchar_t *p; - int i, len; - - iov = uio->uio_iov; - for (; uio->uio_resid != 0; - uio->uio_resid -= len * sizeof (wchar_t), iov++) - { - p = (wchar_t *) iov->iov_base; - len = iov->iov_len / sizeof (wchar_t); - for (i = 0; i < len; i++) - { - if (_fputwc_r (ptr, p[i], fp) == WEOF) - { - err = -1; - goto out; - } - } - } - } - else -#endif - err = __sfvwrite_r(ptr, fp, uio); + err = __sfvwrite_r(ptr, fp, uio); out: uio->uio_resid = 0; uio->uio_iovcnt = 0; @@ -407,27 +382,11 @@ __sfputs_r (struct _reent *ptr, { register int i; -#if defined _WIDE_ORIENT && (!defined _ELIX_LEVEL || _ELIX_LEVEL >= 4) - if (fp->_flags2 & __SWID) - { - wchar_t *p; - - p = (wchar_t *) buf; - for (i = 0; i < (len / sizeof (wchar_t)); i++) - { - if (_fputwc_r (ptr, p[i], fp) == WEOF) - return -1; - } - } - else -#endif + for (i = 0; i < len; i++) { - for (i = 0; i < len; i++) - { - /* Call __sfputc_r to skip _fputc_r. */ - if (__sfputc_r (ptr, (int)buf[i], fp) == EOF) - return -1; - } + /* Call __sfputc_r to skip _fputc_r. */ + if (__sfputc_r (ptr, (int)buf[i], fp) == EOF) + return -1; } return (0); } diff --git a/newlib/libc/stdio/vfprintf.c b/newlib/libc/stdio/vfprintf.c index 6a198e2c6..95412ced9 100644 --- a/newlib/libc/stdio/vfprintf.c +++ b/newlib/libc/stdio/vfprintf.c @@ -187,7 +187,7 @@ static char *rcsid = "$Id$"; # endif #endif -/* The __sprint_r/__ssprint_r functions are shared between all versions of +/* The __ssputs_r/__ssprint_r functions are shared between all versions of vfprintf and vfwprintf. They must only be defined once, which we do in the INTEGER_ONLY versions here. */ #ifdef STRING_ONLY @@ -370,23 +370,9 @@ __sfputs_r (struct _reent *ptr, { register int i; -#if defined _WIDE_ORIENT && (!defined _ELIX_LEVEL || _ELIX_LEVEL >= 4) - if (fp->_flags2 & __SWID) { - wchar_t *p; - - p = (wchar_t *) buf; - for (i = 0; i < (len / sizeof (wchar_t)); i++) { - if (_fputwc_r (ptr, p[i], fp) == WEOF) - return -1; - } - } else { -#else - { -#endif - for (i = 0; i < len; i++) { - if (_fputc_r (ptr, buf[i], fp) == EOF) - return -1; - } + for (i = 0; i < len; i++) { + if (_fputc_r (ptr, buf[i], fp) == EOF) + return -1; } return (0); } @@ -406,27 +392,7 @@ __sprint_r (struct _reent *ptr, uio->uio_iovcnt = 0; return (0); } -#if defined _WIDE_ORIENT && (!defined _ELIX_LEVEL || _ELIX_LEVEL >= 4) - if (fp->_flags2 & __SWID) { - struct __siov *iov; - wchar_t *p; - int i, len; - - iov = uio->uio_iov; - for (; uio->uio_resid != 0; - uio->uio_resid -= len * sizeof (wchar_t), iov++) { - p = (wchar_t *) iov->iov_base; - len = iov->iov_len / sizeof (wchar_t); - for (i = 0; i < len; i++) { - if (_fputwc_r (ptr, p[i], fp) == WEOF) { - err = -1; - goto out; - } - } - } - } else -#endif - err = __sfvwrite_r(ptr, fp, uio); + err = __sfvwrite_r(ptr, fp, uio); out: uio->uio_resid = 0; uio->uio_iovcnt = 0; diff --git a/newlib/libc/stdio/vfwprintf.c b/newlib/libc/stdio/vfwprintf.c index 7807a1229..de494f44a 100644 --- a/newlib/libc/stdio/vfwprintf.c +++ b/newlib/libc/stdio/vfwprintf.c @@ -155,18 +155,95 @@ int _VFWPRINTF_R (struct _reent *, FILE *, const wchar_t *, va_list); # ifdef STRING_ONLY # define __SPRINT __ssprint_r # else -# define __SPRINT __sprint_r +# define __SPRINT __swprint_r # endif int __SPRINT (struct _reent *, FILE *, register struct __suio *); #else # ifdef STRING_ONLY # define __SPRINT __ssputs_r # else -# define __SPRINT __sfputs_r +# define __SPRINT __sfputws_r # endif int __SPRINT (struct _reent *, FILE *, const char *, size_t); #endif + #ifndef STRING_ONLY +#ifdef INTEGER_ONLY +#ifndef _FVWRITE_IN_STREAMIO +int +__sfputws_r (struct _reent *ptr, + FILE *fp, + const char *buf, + size_t len) +{ + register int i; + +#if defined _WIDE_ORIENT && (!defined _ELIX_LEVEL || _ELIX_LEVEL >= 4) + wchar_t *p; + + p = (wchar_t *) buf; + for (i = 0; i < (len / sizeof (wchar_t)); i++) { + if (_fputwc_r (ptr, p[i], fp) == WEOF) + return -1; + } +#else + for (i = 0; i < len; i++) { + if (_fputc_r (ptr, buf[i], fp) == EOF) + return -1; + } +#endif + return (0); +} +#endif +/* + * Flush out all the vectors defined by the given uio, + * then reset it so that it can be reused. + */ +int +__swprint_r (struct _reent *ptr, + FILE *fp, + register struct __suio *uio) +{ + register int err = 0; + + if (uio->uio_resid == 0) { + uio->uio_iovcnt = 0; + return (0); + } +#if defined _WIDE_ORIENT && (!defined _ELIX_LEVEL || _ELIX_LEVEL >= 4) + do { + struct __siov *iov; + wchar_t *p; + int i, len; + + iov = uio->uio_iov; + for (; uio->uio_resid != 0; + uio->uio_resid -= len * sizeof (wchar_t), iov++) { + p = (wchar_t *) iov->iov_base; + len = iov->iov_len / sizeof (wchar_t); + for (i = 0; i < len; i++) { + if (_fputwc_r (ptr, p[i], fp) == WEOF) { + err = -1; + goto out; + } + } + } + } while (0); +#else + err = __sfvwrite_r(ptr, fp, uio); +#endif +out: + uio->uio_resid = 0; + uio->uio_iovcnt = 0; + return (err); +} +#else /* !INTEGER_ONLY */ +#ifndef _FVWRITE_IN_STREAMIO +int __sfputws_r (struct _reent *, FILE *, const char *buf, size_t); +#endif +int __swprint_r (struct _reent *, FILE *, register struct __suio *); +#endif /* !INTEGER_ONLY */ + #ifdef _UNBUF_STREAM_OPT /* * Helper function for `fprintf to unbuffered unix file': creates a