diff options
author | Jonathan Wakely <jwakely@redhat.com> | 2020-06-23 22:47:58 +0100 |
---|---|---|
committer | Jonathan Wakely <jwakely@redhat.com> | 2020-06-24 12:28:13 +0100 |
commit | be50843754b4c4d47f0d628a84b3dbf2a4145a43 (patch) | |
tree | 782b6375869a10c2d234def90cd3961d7eeb1f3f /gcc | |
parent | 3fb2c2f4d0a43b96e9e4907db952e57a5cbe61ef (diff) | |
download | gcc-be50843754b4c4d47f0d628a84b3dbf2a4145a43.zip gcc-be50843754b4c4d47f0d628a84b3dbf2a4145a43.tar.gz gcc-be50843754b4c4d47f0d628a84b3dbf2a4145a43.tar.bz2 |
libstdc++: Fix std::to_chars buffer overflow (PR 95851)
The __detail::__to_chars_2 function assumes it won't be called with zero
values. However, when the output buffer is empty the caller doesn't
handle zero values correctly, and calls __to_chars_2 with a zero value,
resulting in an overflow of the empty buffer.
The __detail::__to_chars_i function should just return immediately for
an empty buffer, and otherwise ensure zero values are handled properly.
libstdc++-v3/ChangeLog:
PR libstdc++/95851
* include/std/charconv (__to_chars_i): Check for zero-sized
buffer unconditionally.
* testsuite/20_util/to_chars/95851.cc: New test.
Diffstat (limited to 'gcc')
0 files changed, 0 insertions, 0 deletions