RepoMirrors/musl
1
0
Fork 0
mirror of git://git.musl-libc.org/musl synced 2025-01-11 17:19:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix FILE buffer underflow in ungetwc

Browse Source 
commit 7e816a6487 (version 1.1.11
release cycle) moved the code that performs wchar_t to multibyte
conversion across code that used the resulting length in bytes,
thereby breaking the unget buffer space check in ungetwc and
clobbering up to three bytes below the start of the buffer.

for allocated FILEs (all read-enabled FILEs except stdin), the
underflow clobbers at most the FILE-specific locale pointer. no stores
are performed through this pointer, but subsequent loads may result in
a crash or mismatching encoding rule (UTF-8 multibyte vs byte-based).

for stdin, the buffer lies in .bss and the underflow may clobber
another object. in practice, for libc.so the adjacent object seems to
be stderr's buffer, which is completely unused, but this could vary
with linking options, or when static linking.

applications which do not attempt to use more than one character of
ungetwc pushback, or which do not use ungetwc, are not affected.
This commit is contained in:
Rich Felker 2016-04-26 15:26:40 -04:00
parent be999f7a54
commit 6ed791e768
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/stdio/ungetwc.c
View File

@ -8,7 +8,7 @@
wint_t ungetwc(wint_t c, FILE *f)
{
unsigned char mbc[MB_LEN_MAX];
int l=1;
int l;
locale_t *ploc = &CURRENT_LOCALE, loc = *ploc;
FLOCK(f);
@ -17,8 +17,8 @@ wint_t ungetwc(wint_t c, FILE *f)
*ploc = f->locale;
if (!f->rpos) __toread(f);
if (!f->rpos || f->rpos < f->buf - UNGET + l || c == WEOF ||
(!isascii(c) && (l = wctomb((void *)mbc, c)) < 0)) {
if (!f->rpos || c == WEOF || (l = wcrtomb((void *)mbc, c, 0)) < 0 ||
f->rpos < f->buf - UNGET + l) {
FUNLOCK(f);
*ploc = loc;
return WEOF;