🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: gnu.utils.bug
Article #1107

glibc1.05 buglet in sprintf/fwrite when typeof(size_t)==int

#1107
From: Robert R. Henry
Date: Tue, 17 Nov 1992 17:04
18 lines
1285 bytes
I built a version of glibc using gcc2.2.2 in a cross
development environment, target=sun3 host=sun4,
intended to run a standalone 68020 based platform.

it seems with this configuration of gcc2.2.2 that size_t is an int,
to be consistent (urgh) with sun-lossage; clearly, it should be
an unsigned.  This is a tremendous rathole, I realize.

in vsprintf is the line
  f.__bufsize = (size_t) (f.__put_limit - f.__bufp);
in which __put_limit is initialized to 0xffffffff;
this ends up giving f.__bufsize a large negative number (since size_t
is an int), which then causes these lines in fwrite
	if (n > buffer_space)
	  n = buffer_space;
to be executed (n is now < 0), which is later used as an argument to
	    memcpy ((PTR) stream->__bufp, (PTR) p, n);
and since n < 0 memcpy fortunately copies nothing.
Technical Details
Message-ID: <9211171704.AA04319@tera.com>
Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!sgiblab!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!tera.com!rrh

Show Full Headers
Complete Article Headers
Newsgroups: gnu.utils.bug
Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!sgiblab!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!tera.com!rrh
From: rrh@tera.com (Robert R. Henry)
Subject: glibc1.05 buglet in sprintf/fwrite when typeof(size_t)==int
Message-ID: <9211171704.AA04319@tera.com>
Sender: gnulists@ai.mit.edu
Organization: GNUs Not Usenet
Distribution: gnu
Date: Tue, 17 Nov 1992 17:04:07 GMT
Approved: bug-gnu-utils@prep.ai.mit.edu
Lines: 20