🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

1 total messages Started by Robert R. Henry Tue, 17 Nov 1992 17:04
glibc1.05 buglet in sprintf/fwrite when typeof(size_t)==int
#1107
Author: Robert R. Henry
Date: Tue, 17 Nov 1992 17:04
18 lines
1285 bytes
I built a version of glibc using gcc2.2.2 in a cross
development environment, target=sun3 host=sun4,
intended to run a standalone 68020 based platform.

it seems with this configuration of gcc2.2.2 that size_t is an int,
to be consistent (urgh) with sun-lossage; clearly, it should be
an unsigned.  This is a tremendous rathole, I realize.

in vsprintf is the line
  f.__bufsize = (size_t) (f.__put_limit - f.__bufp);
in which __put_limit is initialized to 0xffffffff;
this ends up giving f.__bufsize a large negative number (since size_t
is an int), which then causes these lines in fwrite
	if (n > buffer_space)
	  n = buffer_space;
to be executed (n is now < 0), which is later used as an argument to
	    memcpy ((PTR) stream->__bufp, (PTR) p, n);
and since n < 0 memcpy fortunately copies nothing.
Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads