rpms
/
glibc
7
0
Fork 1
Code Issues Pull Requests Releases Activity
glibc/SOURCES/glibc-rh1764241.patch

545 lines
18 KiB
Diff
Raw Permalink Blame History

commit 09e1b0e3f6facc1af2dbcfef204f0aaa8718772b
Author: Florian Weimer <fweimer@redhat.com>
Date: Mon May 20 21:54:57 2019 +0200
libio: Remove codecvt vtable [BZ #24588]
The codecvt vtable is not a real vtable because it also contains the
conversion state data. Furthermore, wide stream support was added to
GCC 3.0, after a C++ ABI bump, so there is no compatibility
requirement with libstdc++.
This change removes several unmangled function pointers which could
be used with a corrupted FILE object to redirect execution. (libio
vtable verification did not cover the codecvt vtable.)
Reviewed-by: Yann Droneaud <ydroneaud@opteya.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
diff --git a/libio/fileops.c b/libio/fileops.c
index d2070a856e..daa5a05877 100644
--- a/libio/fileops.c
+++ b/libio/fileops.c
@@ -331,9 +331,6 @@ _IO_new_file_fopen (FILE *fp, const char *filename, const char *mode,
cc = fp->_codecvt = &fp->_wide_data->_codecvt;
- /* The functions are always the same. */
- *cc = __libio_codecvt;
-
cc->__cd_in.__cd.__nsteps = fcts.towc_nsteps;
cc->__cd_in.__cd.__steps = fcts.towc;
diff --git a/libio/iofgetpos.c b/libio/iofgetpos.c
index 8032192440..388c4a0708 100644
--- a/libio/iofgetpos.c
+++ b/libio/iofgetpos.c
@@ -70,8 +70,7 @@ _IO_new_fgetpos (FILE *fp, __fpos_t *posp)
else
{
posp->__pos = pos;
- if (fp->_mode > 0
- && (*fp->_codecvt->__codecvt_do_encoding) (fp->_codecvt) < 0)
+ if (fp->_mode > 0 && __libio_codecvt_encoding (fp->_codecvt) < 0)
/* This is a stateful encoding, safe the state. */
posp->__state = fp->_wide_data->_IO_state;
}
diff --git a/libio/iofgetpos64.c b/libio/iofgetpos64.c
index 54de6a8205..6a0ba50d29 100644
--- a/libio/iofgetpos64.c
+++ b/libio/iofgetpos64.c
@@ -54,8 +54,7 @@ _IO_new_fgetpos64 (FILE *fp, __fpos64_t *posp)
else
{
posp->__pos = pos;
- if (fp->_mode > 0
- && (*fp->_codecvt->__codecvt_do_encoding) (fp->_codecvt) < 0)
+ if (fp->_mode > 0 && __libio_codecvt_encoding (fp->_codecvt) < 0)
/* This is a stateful encoding, safe the state. */
posp->__state = fp->_wide_data->_IO_state;
}
diff --git a/libio/iofsetpos.c b/libio/iofsetpos.c
index d7b1abbc61..4df1aae082 100644
--- a/libio/iofsetpos.c
+++ b/libio/iofsetpos.c
@@ -58,8 +58,7 @@ _IO_new_fsetpos (FILE *fp, const __fpos_t *posp)
else
{
result = 0;
- if (fp->_mode > 0
- && (*fp->_codecvt->__codecvt_do_encoding) (fp->_codecvt) < 0)
+ if (fp->_mode > 0 && __libio_codecvt_encoding (fp->_codecvt) < 0)
/* This is a stateful encoding, restore the state. */
fp->_wide_data->_IO_state = posp->__state;
}
diff --git a/libio/iofsetpos64.c b/libio/iofsetpos64.c
index d1865b728e..f382ba0dc1 100644
--- a/libio/iofsetpos64.c
+++ b/libio/iofsetpos64.c
@@ -48,8 +48,7 @@ _IO_new_fsetpos64 (FILE *fp, const fpos64_t *posp)
else
{
result = 0;
- if (fp->_mode > 0
- && (*fp->_codecvt->__codecvt_do_encoding) (fp->_codecvt) < 0)
+ if (fp->_mode > 0 && __libio_codecvt_encoding (fp->_codecvt) < 0)
/* This is a stateful encoding, safe the state. */
fp->_wide_data->_IO_state = posp->__state;
}
diff --git a/libio/iofwide.c b/libio/iofwide.c
index 247cfde3d0..80cb2d5074 100644
--- a/libio/iofwide.c
+++ b/libio/iofwide.c
@@ -39,44 +39,6 @@
#include <sysdep.h>
-/* Prototypes of libio's codecvt functions. */
-static enum __codecvt_result do_out (struct _IO_codecvt *codecvt,
- __mbstate_t *statep,
- const wchar_t *from_start,
- const wchar_t *from_end,
- const wchar_t **from_stop, char *to_start,
- char *to_end, char **to_stop);
-static enum __codecvt_result do_unshift (struct _IO_codecvt *codecvt,
- __mbstate_t *statep, char *to_start,
- char *to_end, char **to_stop);
-static enum __codecvt_result do_in (struct _IO_codecvt *codecvt,
- __mbstate_t *statep,
- const char *from_start,
- const char *from_end,
- const char **from_stop, wchar_t *to_start,
- wchar_t *to_end, wchar_t **to_stop);
-static int do_encoding (struct _IO_codecvt *codecvt);
-static int do_length (struct _IO_codecvt *codecvt, __mbstate_t *statep,
- const char *from_start,
- const char *from_end, size_t max);
-static int do_max_length (struct _IO_codecvt *codecvt);
-static int do_always_noconv (struct _IO_codecvt *codecvt);
-
-
-/* The functions used in `codecvt' for libio are always the same. */
-const struct _IO_codecvt __libio_codecvt =
-{
- .__codecvt_destr = NULL, /* Destructor, never used. */
- .__codecvt_do_out = do_out,
- .__codecvt_do_unshift = do_unshift,
- .__codecvt_do_in = do_in,
- .__codecvt_do_encoding = do_encoding,
- .__codecvt_do_always_noconv = do_always_noconv,
- .__codecvt_do_length = do_length,
- .__codecvt_do_max_length = do_max_length
-};
-
-
/* Return orientation of stream. If mode is nonzero try to change
the orientation first. */
#undef _IO_fwide
@@ -118,9 +80,6 @@ _IO_fwide (FILE *fp, int mode)
assert (fcts.towc_nsteps == 1);
assert (fcts.tomb_nsteps == 1);
- /* The functions are always the same. */
- *cc = __libio_codecvt;
-
cc->__cd_in.__cd.__nsteps = fcts.towc_nsteps;
cc->__cd_in.__cd.__steps = fcts.towc;
@@ -150,11 +109,11 @@ _IO_fwide (FILE *fp, int mode)
}
-static enum __codecvt_result
-do_out (struct _IO_codecvt *codecvt, __mbstate_t *statep,
- const wchar_t *from_start, const wchar_t *from_end,
- const wchar_t **from_stop, char *to_start, char *to_end,
- char **to_stop)
+enum __codecvt_result
+__libio_codecvt_out (struct _IO_codecvt *codecvt, __mbstate_t *statep,
+ const wchar_t *from_start, const wchar_t *from_end,
+ const wchar_t **from_stop, char *to_start, char *to_end,
+ char **to_stop)
{
enum __codecvt_result result;
@@ -202,57 +161,11 @@ do_out (struct _IO_codecvt *codecvt, __mbstate_t *statep,
}
-static enum __codecvt_result
-do_unshift (struct _IO_codecvt *codecvt, __mbstate_t *statep,
- char *to_start, char *to_end, char **to_stop)
-{
- enum __codecvt_result result;
-
- struct __gconv_step *gs = codecvt->__cd_out.__cd.__steps;
- int status;
- size_t dummy;
-
- codecvt->__cd_out.__cd.__data[0].__outbuf = (unsigned char *) to_start;
- codecvt->__cd_out.__cd.__data[0].__outbufend = (unsigned char *) to_end;
- codecvt->__cd_out.__cd.__data[0].__statep = statep;
-
- __gconv_fct fct = gs->__fct;
-#ifdef PTR_DEMANGLE
- if (gs->__shlib_handle != NULL)
- PTR_DEMANGLE (fct);
-#endif
-
- status = DL_CALL_FCT (fct,
- (gs, codecvt->__cd_out.__cd.__data, NULL, NULL,
- NULL, &dummy, 1, 0));
-
- *to_stop = (char *) codecvt->__cd_out.__cd.__data[0].__outbuf;
-
- switch (status)
- {
- case __GCONV_OK:
- case __GCONV_EMPTY_INPUT:
- result = __codecvt_ok;
- break;
-
- case __GCONV_FULL_OUTPUT:
- case __GCONV_INCOMPLETE_INPUT:
- result = __codecvt_partial;
- break;
-
- default:
- result = __codecvt_error;
- break;
- }
-
- return result;
-}
-
-
-static enum __codecvt_result
-do_in (struct _IO_codecvt *codecvt, __mbstate_t *statep,
- const char *from_start, const char *from_end, const char **from_stop,
- wchar_t *to_start, wchar_t *to_end, wchar_t **to_stop)
+enum __codecvt_result
+__libio_codecvt_in (struct _IO_codecvt *codecvt, __mbstate_t *statep,
+ const char *from_start, const char *from_end,
+ const char **from_stop,
+ wchar_t *to_start, wchar_t *to_end, wchar_t **to_stop)
{
enum __codecvt_result result;
@@ -300,8 +213,8 @@ do_in (struct _IO_codecvt *codecvt, __mbstate_t *statep,
}
-static int
-do_encoding (struct _IO_codecvt *codecvt)
+int
+__libio_codecvt_encoding (struct _IO_codecvt *codecvt)
{
/* See whether the encoding is stateful. */
if (codecvt->__cd_in.__cd.__steps[0].__stateful)
@@ -317,16 +230,10 @@ do_encoding (struct _IO_codecvt *codecvt)
}
-static int
-do_always_noconv (struct _IO_codecvt *codecvt)
-{
- return 0;
-}
-
-
-static int
-do_length (struct _IO_codecvt *codecvt, __mbstate_t *statep,
- const char *from_start, const char *from_end, size_t max)
+int
+__libio_codecvt_length (struct _IO_codecvt *codecvt, __mbstate_t *statep,
+ const char *from_start, const char *from_end,
+ size_t max)
{
int result;
const unsigned char *cp = (const unsigned char *) from_start;
@@ -353,10 +260,3 @@ do_length (struct _IO_codecvt *codecvt, __mbstate_t *statep,
return result;
}
-
-
-static int
-do_max_length (struct _IO_codecvt *codecvt)
-{
- return codecvt->__cd_in.__cd.__steps[0].__max_needed_from;
-}
diff --git a/libio/libio.h b/libio/libio.h
index c38095ff77..b985c386a2 100644
--- a/libio/libio.h
+++ b/libio/libio.h
@@ -116,40 +116,8 @@ struct _IO_marker {
int _pos;
};
-/* This is the structure from the libstdc++ codecvt class. */
-enum __codecvt_result
-{
- __codecvt_ok,
- __codecvt_partial,
- __codecvt_error,
- __codecvt_noconv
-};
-
-/* The order of the elements in the following struct must match the order
- of the virtual functions in the libstdc++ codecvt class. */
struct _IO_codecvt
{
- void (*__codecvt_destr) (struct _IO_codecvt *);
- enum __codecvt_result (*__codecvt_do_out) (struct _IO_codecvt *,
- __mbstate_t *,
- const wchar_t *,
- const wchar_t *,
- const wchar_t **, char *,
- char *, char **);
- enum __codecvt_result (*__codecvt_do_unshift) (struct _IO_codecvt *,
- __mbstate_t *, char *,
- char *, char **);
- enum __codecvt_result (*__codecvt_do_in) (struct _IO_codecvt *,
- __mbstate_t *,
- const char *, const char *,
- const char **, wchar_t *,
- wchar_t *, wchar_t **);
- int (*__codecvt_do_encoding) (struct _IO_codecvt *);
- int (*__codecvt_do_always_noconv) (struct _IO_codecvt *);
- int (*__codecvt_do_length) (struct _IO_codecvt *, __mbstate_t *,
- const char *, const char *, size_t);
- int (*__codecvt_do_max_length) (struct _IO_codecvt *);
-
_IO_iconv_t __cd_in;
_IO_iconv_t __cd_out;
};
diff --git a/libio/libioP.h b/libio/libioP.h
index 7bdec86a62..66afaa8968 100644
--- a/libio/libioP.h
+++ b/libio/libioP.h
@@ -476,7 +476,6 @@ extern const struct _IO_jump_t _IO_streambuf_jumps;
extern const struct _IO_jump_t _IO_old_proc_jumps attribute_hidden;
extern const struct _IO_jump_t _IO_str_jumps attribute_hidden;
extern const struct _IO_jump_t _IO_wstr_jumps attribute_hidden;
-extern const struct _IO_codecvt __libio_codecvt attribute_hidden;
extern int _IO_do_write (FILE *, const char *, size_t);
libc_hidden_proto (_IO_do_write)
extern int _IO_new_do_write (FILE *, const char *, size_t);
@@ -932,4 +931,32 @@ IO_validate_vtable (const struct _IO_jump_t *vtable)
return vtable;
}
+/* Character set conversion. */
+
+enum __codecvt_result
+{
+ __codecvt_ok,
+ __codecvt_partial,
+ __codecvt_error,
+ __codecvt_noconv
+};
+
+enum __codecvt_result __libio_codecvt_out (struct _IO_codecvt *,
+ __mbstate_t *,
+ const wchar_t *,
+ const wchar_t *,
+ const wchar_t **, char *,
+ char *, char **)
+ attribute_hidden;
+enum __codecvt_result __libio_codecvt_in (struct _IO_codecvt *,
+ __mbstate_t *,
+ const char *, const char *,
+ const char **, wchar_t *,
+ wchar_t *, wchar_t **)
+ attribute_hidden;
+int __libio_codecvt_encoding (struct _IO_codecvt *) attribute_hidden;
+int __libio_codecvt_length (struct _IO_codecvt *, __mbstate_t *,
+ const char *, const char *, size_t)
+ attribute_hidden;
+
#endif /* libioP.h. */
diff --git a/libio/wfileops.c b/libio/wfileops.c
index 69fbb62a02..f1863db638 100644
--- a/libio/wfileops.c
+++ b/libio/wfileops.c
@@ -72,11 +72,11 @@ _IO_wdo_write (FILE *fp, const wchar_t *data, size_t to_do)
}
/* Now convert from the internal format into the external buffer. */
- result = (*cc->__codecvt_do_out) (cc, &fp->_wide_data->_IO_state,
- data, data + to_do, &new_data,
- write_ptr,
- buf_end,
- &write_ptr);
+ result = __libio_codecvt_out (cc, &fp->_wide_data->_IO_state,
+ data, data + to_do, &new_data,
+ write_ptr,
+ buf_end,
+ &write_ptr);
/* Write out what we produced so far. */
if (_IO_new_do_write (fp, write_base, write_ptr - write_base) == EOF)
@@ -140,12 +140,12 @@ _IO_wfile_underflow (FILE *fp)
fp->_wide_data->_IO_last_state = fp->_wide_data->_IO_state;
fp->_wide_data->_IO_read_base = fp->_wide_data->_IO_read_ptr =
fp->_wide_data->_IO_buf_base;
- status = (*cd->__codecvt_do_in) (cd, &fp->_wide_data->_IO_state,
- fp->_IO_read_ptr, fp->_IO_read_end,
- &read_stop,
- fp->_wide_data->_IO_read_ptr,
- fp->_wide_data->_IO_buf_end,
- &fp->_wide_data->_IO_read_end);
+ status = __libio_codecvt_in (cd, &fp->_wide_data->_IO_state,
+ fp->_IO_read_ptr, fp->_IO_read_end,
+ &read_stop,
+ fp->_wide_data->_IO_read_ptr,
+ fp->_wide_data->_IO_buf_end,
+ &fp->_wide_data->_IO_read_end);
fp->_IO_read_base = fp->_IO_read_ptr;
fp->_IO_read_ptr = (char *) read_stop;
@@ -266,11 +266,11 @@ _IO_wfile_underflow (FILE *fp)
naccbuf += to_copy;
from = accbuf;
}
- status = (*cd->__codecvt_do_in) (cd, &fp->_wide_data->_IO_state,
- from, to, &read_ptr_copy,
- fp->_wide_data->_IO_read_end,
- fp->_wide_data->_IO_buf_end,
- &fp->_wide_data->_IO_read_end);
+ status = __libio_codecvt_in (cd, &fp->_wide_data->_IO_state,
+ from, to, &read_ptr_copy,
+ fp->_wide_data->_IO_read_end,
+ fp->_wide_data->_IO_buf_end,
+ &fp->_wide_data->_IO_read_end);
if (__glibc_unlikely (naccbuf != 0))
fp->_IO_read_ptr += MAX (0, read_ptr_copy - &accbuf[naccbuf - to_copy]);
@@ -372,12 +372,12 @@ _IO_wfile_underflow_mmap (FILE *fp)
fp->_wide_data->_IO_last_state = fp->_wide_data->_IO_state;
fp->_wide_data->_IO_read_base = fp->_wide_data->_IO_read_ptr =
fp->_wide_data->_IO_buf_base;
- (*cd->__codecvt_do_in) (cd, &fp->_wide_data->_IO_state,
- fp->_IO_read_ptr, fp->_IO_read_end,
- &read_stop,
- fp->_wide_data->_IO_read_ptr,
- fp->_wide_data->_IO_buf_end,
- &fp->_wide_data->_IO_read_end);
+ __libio_codecvt_in (cd, &fp->_wide_data->_IO_state,
+ fp->_IO_read_ptr, fp->_IO_read_end,
+ &read_stop,
+ fp->_wide_data->_IO_read_ptr,
+ fp->_wide_data->_IO_buf_end,
+ &fp->_wide_data->_IO_read_end);
fp->_IO_read_ptr = (char *) read_stop;
@@ -495,7 +495,7 @@ _IO_wfile_sync (FILE *fp)
struct _IO_codecvt *cv = fp->_codecvt;
off64_t new_pos;
- int clen = (*cv->__codecvt_do_encoding) (cv);
+ int clen = __libio_codecvt_encoding (cv);
if (clen > 0)
/* It is easy, a fixed number of input bytes are used for each
@@ -511,9 +511,9 @@ _IO_wfile_sync (FILE *fp)
size_t wnread = (fp->_wide_data->_IO_read_ptr
- fp->_wide_data->_IO_read_base);
fp->_wide_data->_IO_state = fp->_wide_data->_IO_last_state;
- nread = (*cv->__codecvt_do_length) (cv, &fp->_wide_data->_IO_state,
- fp->_IO_read_base,
- fp->_IO_read_end, wnread);
+ nread = __libio_codecvt_length (cv, &fp->_wide_data->_IO_state,
+ fp->_IO_read_base,
+ fp->_IO_read_end, wnread);
fp->_IO_read_ptr = fp->_IO_read_base + nread;
delta = -(fp->_IO_read_end - fp->_IO_read_base - nread);
}
@@ -548,7 +548,7 @@ adjust_wide_data (FILE *fp, bool do_convert)
{
struct _IO_codecvt *cv = fp->_codecvt;
- int clen = (*cv->__codecvt_do_encoding) (cv);
+ int clen = __libio_codecvt_encoding (cv);
/* Take the easy way out for constant length encodings if we don't need to
convert. */
@@ -565,12 +565,12 @@ adjust_wide_data (FILE *fp, bool do_convert)
{
fp->_wide_data->_IO_last_state = fp->_wide_data->_IO_state;
- status = (*cv->__codecvt_do_in) (cv, &fp->_wide_data->_IO_state,
- fp->_IO_read_base, fp->_IO_read_ptr,
- &read_stop,
- fp->_wide_data->_IO_read_base,
- fp->_wide_data->_IO_buf_end,
- &fp->_wide_data->_IO_read_end);
+ status = __libio_codecvt_in (cv, &fp->_wide_data->_IO_state,
+ fp->_IO_read_base, fp->_IO_read_ptr,
+ &read_stop,
+ fp->_wide_data->_IO_read_base,
+ fp->_wide_data->_IO_buf_end,
+ &fp->_wide_data->_IO_read_end);
/* Should we return EILSEQ? */
if (__glibc_unlikely (status == __codecvt_error))
@@ -648,7 +648,7 @@ do_ftell_wide (FILE *fp)
}
struct _IO_codecvt *cv = fp->_codecvt;
- int clen = (*cv->__codecvt_do_encoding) (cv);
+ int clen = __libio_codecvt_encoding (cv);
if (!unflushed_writes)
{
@@ -663,9 +663,9 @@ do_ftell_wide (FILE *fp)
size_t delta = wide_read_ptr - wide_read_base;
__mbstate_t state = fp->_wide_data->_IO_last_state;
- nread = (*cv->__codecvt_do_length) (cv, &state,
- fp->_IO_read_base,
- fp->_IO_read_end, delta);
+ nread = __libio_codecvt_length (cv, &state,
+ fp->_IO_read_base,
+ fp->_IO_read_end, delta);
offset -= fp->_IO_read_end - fp->_IO_read_base - nread;
}
}
@@ -688,9 +688,8 @@ do_ftell_wide (FILE *fp)
enum __codecvt_result status;
__mbstate_t state = fp->_wide_data->_IO_last_state;
- status = (*cv->__codecvt_do_out) (cv, &state,
- in, in + delta, &in,
- out, out + outsize, &outstop);
+ status = __libio_codecvt_out (cv, &state, in, in + delta, &in,
+ out, out + outsize, &outstop);
/* We don't check for __codecvt_partial because it can be
returned on one of two conditions: either the output
@@ -801,7 +800,7 @@ _IO_wfile_seekoff (FILE *fp, off64_t offset, int dir, int mode)
find out which position in the external buffer corresponds to
the current position in the internal buffer. */
cv = fp->_codecvt;
- clen = (*cv->__codecvt_do_encoding) (cv);
+ clen = __libio_codecvt_encoding (cv);
if (mode != 0 || !was_writing)
{
@@ -819,10 +818,10 @@ _IO_wfile_seekoff (FILE *fp, off64_t offset, int dir, int mode)
delta = (fp->_wide_data->_IO_read_ptr
- fp->_wide_data->_IO_read_base);
fp->_wide_data->_IO_state = fp->_wide_data->_IO_last_state;
- nread = (*cv->__codecvt_do_length) (cv,
- &fp->_wide_data->_IO_state,
- fp->_IO_read_base,
- fp->_IO_read_end, delta);
+ nread = __libio_codecvt_length (cv,
+ &fp->_wide_data->_IO_state,
+ fp->_IO_read_base,
+ fp->_IO_read_end, delta);
fp->_IO_read_ptr = fp->_IO_read_base + nread;
fp->_wide_data->_IO_read_end = fp->_wide_data->_IO_read_ptr;
offset -= fp->_IO_read_end - fp->_IO_read_base - nread;
Reference in New Issue View Git Blame Copy Permalink