Thread View: gnu.utils.bug
1 messages
1 total messages
Started by Robert R. Henry
Tue, 17 Nov 1992 17:04
glibc1.05 buglet in sprintf/fwrite when typeof(size_t)==int
Author: Robert R. Henry
Date: Tue, 17 Nov 1992 17:04
Date: Tue, 17 Nov 1992 17:04
18 lines
1285 bytes
1285 bytes
I built a version of glibc using gcc2.2.2 in a cross development environment, target=sun3 host=sun4, intended to run a standalone 68020 based platform. it seems with this configuration of gcc2.2.2 that size_t is an int, to be consistent (urgh) with sun-lossage; clearly, it should be an unsigned. This is a tremendous rathole, I realize. in vsprintf is the line f.__bufsize = (size_t) (f.__put_limit - f.__bufp); in which __put_limit is initialized to 0xffffffff; this ends up giving f.__bufsize a large negative number (since size_t is an int), which then causes these lines in fwrite if (n > buffer_space) n = buffer_space; to be executed (n is now < 0), which is later used as an argument to memcpy ((PTR) stream->__bufp, (PTR) p, n); and since n < 0 memcpy fortunately copies nothing.
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads