AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-09-19 16:10:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

vfscanf-internal: Remove potentially unbounded allocas

Browse Source 
Some locales define a list of mapping pairs of alternate digits and
separators for input digits (to_inpunct).  This require the scanf
to create a list of all possible inputs for the optional type
modifier 'I'.

Checked on x86_64-linux-gnu.

Reviewed-by: Joe Simmons-Talbott <josimmon@redhat.com>
This commit is contained in:
Adhemerval Zanella 2023-06-27 14:05:56 -04:00
parent 5324d25842
commit 320ac7eeb4
5 changed files with 197 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
stdio-common/Makefile
View File

@ -244,6 +244,7 @@ tests := \
tst-scanf-binary-gnu11 \
tst-scanf-binary-gnu89 \
tst-scanf-round \
tst-scanf-to_inpunct \
tst-setvbuf1 \
tst-sprintf \
tst-sprintf-errno \
@ -360,6 +361,7 @@ LOCALES := \
de_DE.ISO-8859-1 \
de_DE.UTF-8 \
en_US.ISO-8859-1 \
fa_IR.UTF-8 \
hi_IN.UTF-8 \
ja_JP.EUC-JP \
ps_AF.UTF-8 \
@ -379,6 +381,7 @@ $(objpfx)tst-swprintf.out: $(gen-locales)
$(objpfx)tst-vfprintf-mbs-prec.out: $(gen-locales)
$(objpfx)tst-vfprintf-width-i18n.out: $(gen-locales)
$(objpfx)tst-grouping3.out: $(gen-locales)
$(objpfx)tst-scanf-to_inpunct.out: $(gen-locales)
endif
tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \

78
stdio-common/tst-scanf-to_inpunct.c Normal file
View File

@ -0,0 +1,78 @@
/* Test scanf for languages with mapping pairs of alternate digits and
separators.
Copyright (C) 2023 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
#include <array_length.h>
#include <stdio.h>
#include <support/support.h>
#include <support/check.h>
/* fa_IR defines to_inpunct for numbers. */
static const struct
{
int n;
const char *str;
} inputs[] =
{
{ 1, "\xdb\xb1" },
{ 2, "\xdb\xb2" },
{ 3, "\xdb\xb3" },
{ 4, "\xdb\xb4" },
{ 5, "\xdb\xb5" },
{ 6, "\xdb\xb6" },
{ 7, "\xdb\xb7" },
{ 8, "\xdb\xb8" },
{ 9, "\xdb\xb9" },
{ 10, "\xdb\xb1\xdb\xb0" },
{ 11, "\xdb\xb1\xdb\xb1" },
{ 12, "\xdb\xb1\xdb\xb2" },
{ 13, "\xdb\xb1\xdb\xb3" },
{ 14, "\xdb\xb1\xdb\xb4" },
{ 15, "\xdb\xb1\xdb\xb5" },
{ 16, "\xdb\xb1\xdb\xb6" },
{ 17, "\xdb\xb1\xdb\xb7" },
{ 18, "\xdb\xb1\xdb\xb8" },
{ 19, "\xdb\xb1\xdb\xb9" },
{ 20, "\xdb\xb2\xdb\xb0" },
{ 30, "\xdb\xb3\xdb\xb0" },
{ 40, "\xdb\xb4\xdb\xb0" },
{ 50, "\xdb\xb5\xdb\xb0" },
{ 60, "\xdb\xb6\xdb\xb0" },
{ 70, "\xdb\xb7\xdb\xb0" },
{ 80, "\xdb\xb8\xdb\xb0" },
{ 90, "\xdb\xb9\xdb\xb0" },
{ 100, "\xdb\xb1\xdb\xb0\xdb\xb0" },
{ 1000, "\xdb\xb1\xdb\xb0\xdb\xb0\xdb\xb0" },
};
static int
do_test (void)
{
xsetlocale (LC_ALL, "fa_IR.UTF-8");
for (int i = 0; i < array_length (inputs); i++)
{
int n;
sscanf (inputs[i].str, "%Id", &n);
TEST_COMPARE (n, inputs[i].n);
}
return 0;
}
#include <support/test-driver.c>

51
stdio-common/vfscanf-internal.c
View File

@ -1455,13 +1455,14 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
int from_level;
int to_level;
int level;
enum { num_digits_len = 10 };
#ifdef COMPILE_WSCANF
const wchar_t *wcdigits[10];
const wchar_t *wcdigits_extended[10];
const wchar_t *wcdigits[num_digits_len];
#else
const char *mbdigits[10];
const char *mbdigits_extended[10];
const char *mbdigits[num_digits_len];
#endif
CHAR_T *digits_extended[num_digits_len] = { NULL };
/* "to_inpunct" is a map from ASCII digits to their
equivalent in locale. This is defined for locales
which use an extra digits set. */
@ -1482,18 +1483,23 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
/* Adding new level for extra digits set in locale file. */
++to_level;
for (n = 0; n < 10; ++n)
for (n = 0; n < num_digits_len; ++n)
{
#ifdef COMPILE_WSCANF
wcdigits[n] = (const wchar_t *)
_NL_CURRENT (LC_CTYPE, _NL_CTYPE_INDIGITS0_WC + n);
wchar_t *wc_extended = (wchar_t *)
alloca ((to_level + 2) * sizeof (wchar_t));
malloc ((to_level + 2) * sizeof (wchar_t));
if (wc_extended == NULL)
{
done = EOF;
goto digits_extended_fail;
}
__wmemcpy (wc_extended, wcdigits[n], to_level);
wc_extended[to_level] = __towctrans (L'0' + n, map);
wc_extended[to_level + 1] = '\0';
wcdigits_extended[n] = wc_extended;
digits_extended[n] = wc_extended;
#else
mbdigits[n]
= curctype->values[_NL_CTYPE_INDIGITS0_MB + n].string;
@ -1524,14 +1530,18 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
size_t mbdigits_len = last_char - mbdigits[n];
/* Allocate memory for extended multibyte digit. */
char *mb_extended;
mb_extended = (char *) alloca (mbdigits_len + mblen + 1);
char *mb_extended = malloc (mbdigits_len + mblen + 1);
if (mb_extended == NULL)
{
done = EOF;
goto digits_extended_fail;
}
/* And get the mbdigits + extra_digit string. */
*(char *) __mempcpy (__mempcpy (mb_extended, mbdigits[n],
mbdigits_len),
extra_mbdigit, mblen) = '\0';
mbdigits_extended[n] = mb_extended;
digits_extended[n] = mb_extended;
#endif
}
}
@ -1541,7 +1551,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
{
/* In this round we get the pointer to the digit strings
and also perform the first round of comparisons. */
for (n = 0; n < 10; ++n)
for (n = 0; n < num_digits_len; ++n)
{
/* Get the string for the digits with value N. */
#ifdef COMPILE_WSCANF
@ -1553,7 +1563,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
DIAG_IGNORE_NEEDS_COMMENT (4.7, "-Wmaybe-uninitialized");
if (__glibc_unlikely (map != NULL))
wcdigits[n] = wcdigits_extended[n];
wcdigits[n] = digits_extended[n];
else
wcdigits[n] = (const wchar_t *)
_NL_CURRENT (LC_CTYPE, _NL_CTYPE_INDIGITS0_WC + n);
@ -1574,7 +1584,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
int avail = width > 0 ? width : INT_MAX;
if (__glibc_unlikely (map != NULL))
mbdigits[n] = mbdigits_extended[n];
mbdigits[n] = digits_extended[n];
else
mbdigits[n]
= curctype->values[_NL_CTYPE_INDIGITS0_MB + n].string;
@ -1617,13 +1627,13 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
#endif
}
if (n == 10)
if (n == num_digits_len)
{
/* Have not yet found the digit. */
for (level = from_level + 1; level <= to_level; ++level)
{
/* Search all ten digits of this level. */
for (n = 0; n < 10; ++n)
for (n = 0; n < num_digits_len; ++n)
{
#ifdef COMPILE_WSCANF
if (c == (wint_t) *wcdigits[n])
@ -1679,7 +1689,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
}
}
if (n < 10)
if (n < num_digits_len)
c = L_('0') + n;
else if (flags & GROUP)
{
@ -1708,7 +1718,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
{
__set_errno (ENOMEM);
done = EOF;
goto errout;
break;
}
if (*cmpp != '\0')
@ -1742,6 +1752,13 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
c = inchar ();
}
digits_extended_fail:
for (n = 0; n < num_digits_len; n++)
free (digits_extended[n]);
if (done == EOF)
goto errout;
}
else
/* Read the number into workspace. */

3
wcsmbs/Makefile
View File

@ -196,6 +196,7 @@ tests := \
tst-wscanf-binary-c2x \
tst-wscanf-binary-gnu11 \
tst-wscanf-binary-gnu89 \
tst-wscanf-to_inpunct \
wcsatcliff \
wcsmbs-tst1 \
# tests
@ -207,6 +208,7 @@ LOCALES := \
de_DE.ISO-8859-1 \
de_DE.UTF-8 \
en_US.ANSI_X3.4-1968 \
fa_IR.UTF-8 \
hr_HR.ISO-8859-2 \
ja_JP.EUC-JP \
tr_TR.ISO-8859-9 \
@ -228,6 +230,7 @@ $(objpfx)tst-c16-surrogate.out: $(gen-locales)
$(objpfx)tst-c32-state.out: $(gen-locales)
$(objpfx)test-c8rtomb.out: $(gen-locales)
$(objpfx)test-mbrtoc8.out: $(gen-locales)
$(objpfx)tst-wscanf-to_inpunct.out: $(gen-locales)
endif
$(objpfx)tst-wcstod-round: $(libm)

79
wcsmbs/tst-wscanf-to_inpunct.c Normal file
View File

@ -0,0 +1,79 @@
/* Test scanf for languages with mapping pairs of alternate digits and
separators.
Copyright (C) 2023 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<https://www.gnu.org/licenses/>. */
#include <array_length.h>
#include <stdio.h>
#include <support/support.h>
#include <support/check.h>
#include <wchar.h>
/* fa_IR defines to_inpunct for numbers. */
static const struct input_t
{
int n;
const wchar_t str[5];
} inputs[] =
{
{ 1, { 0x000006f1, L'\0' } },
{ 2, { 0x000006f2, L'\0' } },
{ 3, { 0x000006f3, L'\0' } },
{ 4, { 0x000006f4, L'\0' } },
{ 5, { 0x000006f5, L'\0' } },
{ 6, { 0x000006f6, L'\0' } },
{ 7, { 0x000006f7, L'\0' } },
{ 8, { 0x000006f8, L'\0' } },
{ 9, { 0x000006f9, L'\0' } },
{ 10, { 0x000006f1, 0x000006f0, L'\0' } },
{ 11, { 0x000006f1, 0x000006f1, L'\0' } },
{ 12, { 0x000006f1, 0x000006f2, L'\0' } },
{ 13, { 0x000006f1, 0x000006f3, L'\0' } },
{ 14, { 0x000006f1, 0x000006f4, L'\0' } },
{ 15, { 0x000006f1, 0x000006f5, L'\0' } },
{ 16, { 0x000006f1, 0x000006f6, L'\0' } },
{ 17, { 0x000006f1, 0x000006f7, L'\0' } },
{ 18, { 0x000006f1, 0x000006f8, L'\0' } },
{ 19, { 0x000006f1, 0x000006f9, L'\0' } },
{ 20, { 0x000006f2, 0x000006f0, L'\0' } },
{ 30, { 0x000006f3, 0x000006f0, L'\0' } },
{ 40, { 0x000006f4, 0x000006f0, L'\0' } },
{ 50, { 0x000006f5, 0x000006f0, L'\0' } },
{ 60, { 0x000006f6, 0x000006f0, L'\0' } },
{ 70, { 0x000006f7, 0x000006f0, L'\0' } },
{ 80, { 0x000006f8, 0x000006f0, L'\0' } },
{ 90, { 0x000006f9, 0x000006f0, L'\0' } },
{ 100, { 0x000006f1, 0x000006f0, 0x000006f0, L'\0' } },
{ 1000, { 0x000006f1, 0x000006f0, 0x000006f0, 0x000006f0, L'\0' } },
};
static int
do_test (void)
{
xsetlocale (LC_ALL, "fa_IR.UTF-8");
for (int i = 0; i < array_length (inputs); i++)
{
int n;
swscanf (inputs[i].str, L"%Id", &n);
TEST_COMPARE (n, inputs[i].n);
}
return 0;
}
#include <support/test-driver.c>