From 118816de3383ff12769349784689141355cc787c Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Mon, 19 Dec 2022 18:56:55 +0100
Subject: libio: Convert __vswprintf_internal to buffers (bug 27857)

Always null-terminate the buffer and set E2BIG if the buffer is too
small.  This fixes bug 27857.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
---
 stdio-common/wprintf_buffer_flush.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'stdio-common/wprintf_buffer_flush.c')

diff --git a/stdio-common/wprintf_buffer_flush.c b/stdio-common/wprintf_buffer_flush.c
index 2d91095..46af0f3 100644
--- a/stdio-common/wprintf_buffer_flush.c
+++ b/stdio-common/wprintf_buffer_flush.c
@@ -16,6 +16,7 @@
    License along with the GNU C Library; if not, see
    <https://www.gnu.org/licenses/>.  */
 
+#include <errno.h>
 #include <printf_buffer.h>
 
 #include "printf_buffer-wchar_t.h"
@@ -31,6 +32,11 @@ __wprintf_buffer_do_flush (struct __wprintf_buffer *buf)
     case __wprintf_buffer_mode_to_file:
       __wprintf_buffer_flush_to_file ((struct __wprintf_buffer_to_file *) buf);
       return;
+    case __wprintf_buffer_mode_swprintf:
+      buf->write_end[-1] = L'\0';
+      __set_errno (E2BIG);
+      __wprintf_buffer_mark_failed (buf);
+      return;
     }
   __builtin_trap ();
 }
-- 
cgit v1.1