libio: Fix crash in fputws [BZ #20632]

This fixes a buffer overflow in wide character string output, reproducing
when output fails, such as if the output fd is closed or is redirected
to a full device.

Wide character output data attempts to maintain the invariant that
`_IO_buf_base <= _IO_write_base <= _IO_write_end <= _IO_buf_end` (that is,
that the write region is a sub-region of `_IO_buf`). Prior to this commit,
this invariant is violated by the `_IO_wfile_overflow` function as so:

1. `_IO_wsetg` is called, assigning `_IO_write_base` to `_IO_buf_base`
2. `_IO_doallocbuf` is called, which jumps to `_IO_wfile_doallocate` via
    the _IO_wfile_jumps vtable. This function then assigns the wide data
    `_IO_buf_base` and `_IO_buf_end` to a malloc'd buffer.

Thus the invariant is violated. The fix is simply to reverse the order:
malloc the `_IO_buf` first and then assign `_IO_write_base` to it.

We also take this opportunity to defensively guard the initialization of
the number of unwritten characters via pointer arithmetic. We now check
that the buffer end is not before the buffer beginning; this matches a
similar defensive check in the narrow analogue `fileops.c`.

Add a test which fails without the fix.

Signed-off-by: Peter Ammon <corydoras@ridiculousfish.com>
Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

1 files changed, 2 insertions, 0 deletions

diff --git a/libio/Makefile b/libio/Makefile
index cd5a3af..4370152 100644
--- a/libio/Makefile
+++ b/libio/Makefile
@@ -86,6 +86,8 @@ tests = \
   bug-wmemstream1 \
   bug-wsetpos \
   test-fmemopen \
+  test-fputs-unbuffered-full \
+  test-fputws-unbuffered-full \
   tst-atime \
   tst-bz22415 \
   tst-bz24051 \