From 135ffda8b84226a91c6062db69a61975b2f11cb6 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Mon, 2 Apr 2012 14:31:19 -0700 Subject: Tighten up vfprintf width, precision, and total length overflow handling. With help from Paul Eggert, Carlos O'Donell, and Roland McGrath. * stdio-common/printf-parse.h (read_int): Change return type to 'int', return -1 on INT_MAX overflow. * stdio-common/vfprintf.c (vfprintf): Validate width and precision against overflow of INT_MAX. Set errno to EOVERFLOW when 'done' overflows INT_MAX. Check for overflow of in-format-string precision values properly. Use EOVERFLOW rather than ERANGE throughout. Use SIZE_MAX not INT_MAX for integer overflow test. * stdio-common/printf-parsemb.c: If read_int signals an overflow, skip the construct in the format string but do not record anything. * stdio-common/bug22.c: Adjust to test both width/prevision INT_MAX overflow as well as total length INT_MAX overflow. Check explicitly for proper errno values. --- stdio-common/bug22.c | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) (limited to 'stdio-common/bug22.c') diff --git a/stdio-common/bug22.c b/stdio-common/bug22.c index 2228388..efd9501 100644 --- a/stdio-common/bug22.c +++ b/stdio-common/bug22.c @@ -1,12 +1,22 @@ /* BZ #5424 */ #include +#include +/* INT_MAX + 1 */ #define N 2147483648 +/* (INT_MAX / 2) + 2 */ +#define N2 1073741825 + +/* INT_MAX - 3 */ +#define N3 2147483644 + #define STRINGIFY(S) #S #define MAKE_STR(S) STRINGIFY(S) #define SN MAKE_STR(N) +#define SN2 MAKE_STR(N2) +#define SN3 MAKE_STR(N3) static int do_test (void) @@ -20,11 +30,25 @@ do_test (void) return 1; } - ret = fprintf (fp, "%" SN "d%" SN "d", 1, 1); + ret = fprintf (fp, "%" SN "d", 1); + printf ("ret = %d\n", ret); + if (ret != -1 || errno != EOVERFLOW) + return 1; + + ret = fprintf (fp, "%." SN "d", 1); + printf ("ret = %d\n", ret); + if (ret != -1 || errno != EOVERFLOW) + return 1; + + ret = fprintf (fp, "%." SN3 "d", 1); + printf ("ret = %d\n", ret); + if (ret != -1 || errno != EOVERFLOW) + return 1; + ret = fprintf (fp, "%" SN2 "d%" SN2 "d", 1, 1); printf ("ret = %d\n", ret); - return ret != -1; + return ret != -1 || errno != EOVERFLOW; } #define TIMEOUT 30 -- cgit v1.1