Article View: gnu.utils.bug
Article #1107glibc1.05 buglet in sprintf/fwrite when typeof(size_t)==int
From: Robert R. Henry
Date: Tue, 17 Nov 1992 17:04
Date: Tue, 17 Nov 1992 17:04
18 lines
1285 bytes
1285 bytes
I built a version of glibc using gcc2.2.2 in a cross development environment, target=sun3 host=sun4, intended to run a standalone 68020 based platform. it seems with this configuration of gcc2.2.2 that size_t is an int, to be consistent (urgh) with sun-lossage; clearly, it should be an unsigned. This is a tremendous rathole, I realize. in vsprintf is the line f.__bufsize = (size_t) (f.__put_limit - f.__bufp); in which __put_limit is initialized to 0xffffffff; this ends up giving f.__bufsize a large negative number (since size_t is an int), which then causes these lines in fwrite if (n > buffer_space) n = buffer_space; to be executed (n is now < 0), which is later used as an argument to memcpy ((PTR) stream->__bufp, (PTR) p, n); and since n < 0 memcpy fortunately copies nothing.
Technical Details
Message-ID:
<9211171704.AA04319@tera.com>Path:
arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!sgiblab!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!tera.com!rrhShow Full Headers
Complete Article Headers
Newsgroups: gnu.utils.bug Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!sgiblab!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!tera.com!rrh From: rrh@tera.com (Robert R. Henry) Subject: glibc1.05 buglet in sprintf/fwrite when typeof(size_t)==int Message-ID: <9211171704.AA04319@tera.com> Sender: gnulists@ai.mit.edu Organization: GNUs Not Usenet Distribution: gnu Date: Tue, 17 Nov 1992 17:04:07 GMT Approved: bug-gnu-utils@prep.ai.mit.edu Lines: 20