2a30b8f4b2
Upstream commit: dcaf51b41e259387602774829c45222d0507f90a - elf: Change ldconfig auxcache magic number (bug 32231) - Make tst-strtod-underflow type-generic - Add crt1-2.0.o for glibc 2.0 compatibility tests - Add tests of more strtod special cases - Add more tests of strtod end pointer - Make tst-strtod2 and tst-strtod5 type-generic - powerpc64le: Build new strtod tests with long double ABI flags (bug 32145) - Do not set errno for overflowing NaN payload in strtod/nan (bug 32045) - Improve NaN payload testing - Make __strtod_internal tests type-generic - Fix strtod subnormal rounding (bug 30220) - More thoroughly test underflow / errno in tst-strtod-round - Test errno setting on strtod overflow in tst-strtod-round - Add tests of fread - stdio-common: Add new test for fdopen - libio: Attempt wide backup free only for non-legacy code - debug: Fix read error handling in pcprofiledump - elf: Fix tst-dlopen-tlsreinit1.out test dependency - elf: Avoid re-initializing already allocated TLS in dlopen (bug 31717) - elf: Clarify and invert second argument of _dl_allocate_tls_init - elf: Support recursive use of dynamic TLS in interposed malloc - nptl: Use <support/check.h> facilities in tst-setuid3 - posix: Use <support/check.h> facilities in tst-truncate and tst-truncate64 - ungetc: Fix backup buffer leak on program exit [BZ #27821] - ungetc: Fix uninitialized read when putting into unused streams [BZ #27821] - Make tst-ungetc use libsupport - stdio-common: Add test for vfscanf with matches longer than INT_MAX [BZ #27650] - support: Add FAIL test failure helper - string: strerror, strsignal cannot use buffer after dlmopen (bug 32026) - Define __libc_initial for the static libc - x86: Fix bug in strchrnul-evex512 [BZ #32078] - Adjust check-local-headers test for libaudit 4.0 - x32/cet: Support shadow stack during startup for Linux 6.10 - x86-64: Remove sysdeps/x86_64/x32/dl-machine.h - support: Add options list terminator to the test driver - manual/stdio: Further clarify putc, putwc, getc, and getwc - Fix name space violation in fortify wrappers (bug 32052) - resolv: Fix tst-resolv-short-response for older GCC (bug 32042) - Add mremap tests - mremap: Update manual entry - linux: Update the mremap C implementation [BZ #31968] - Enhanced test coverage for strncmp, wcsncmp - Enhance test coverage for strnlen, wcsnlen Resolves: RHEL-57776 Resolves: RHEL-57777 Resolves: RHEL-61392
71 lines
3.1 KiB
Diff
71 lines
3.1 KiB
Diff
commit 70939528c67507f12d6d41423b7fac25153a6dce
|
|
Author: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
|
Date: Tue Aug 13 21:00:06 2024 -0400
|
|
|
|
ungetc: Fix uninitialized read when putting into unused streams [BZ #27821]
|
|
|
|
When ungetc is called on an unused stream, the backup buffer is
|
|
allocated without the main get area being present. This results in
|
|
every subsequent ungetc (as the stream remains in the backup area)
|
|
checking uninitialized memory in the backup buffer when trying to put a
|
|
character back into the stream.
|
|
|
|
Avoid comparing the input character with buffer contents when in backup
|
|
to avoid this uninitialized read. The uninitialized read is harmless in
|
|
this context since the location is promptly overwritten with the input
|
|
character, thus fulfilling ungetc functionality.
|
|
|
|
Also adjust wording in the manual to drop the paragraph that says glibc
|
|
cannot do multiple ungetc back to back since with this change, ungetc
|
|
can actually do this.
|
|
|
|
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
|
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
|
(cherry picked from commit cdf0f88f97b0aaceb894cc02b21159d148d7065c)
|
|
|
|
diff --git a/libio/genops.c b/libio/genops.c
|
|
index bc45e60a09437ae5..4f5c6136f3ef1b88 100644
|
|
--- a/libio/genops.c
|
|
+++ b/libio/genops.c
|
|
@@ -635,7 +635,7 @@ _IO_sputbackc (FILE *fp, int c)
|
|
{
|
|
int result;
|
|
|
|
- if (fp->_IO_read_ptr > fp->_IO_read_base
|
|
+ if (fp->_IO_read_ptr > fp->_IO_read_base && !_IO_in_backup (fp)
|
|
&& (unsigned char)fp->_IO_read_ptr[-1] == (unsigned char)c)
|
|
{
|
|
fp->_IO_read_ptr--;
|
|
diff --git a/manual/stdio.texi b/manual/stdio.texi
|
|
index 0b31aeff958528c6..393ed9c665792609 100644
|
|
--- a/manual/stdio.texi
|
|
+++ b/manual/stdio.texi
|
|
@@ -1467,11 +1467,9 @@ program; usually @code{ungetc} is used only to unread a character that
|
|
was just read from the same stream. @Theglibc{} supports this
|
|
even on files opened in binary mode, but other systems might not.
|
|
|
|
-@Theglibc{} only supports one character of pushback---in other
|
|
-words, it does not work to call @code{ungetc} twice without doing input
|
|
-in between. Other systems might let you push back multiple characters;
|
|
-then reading from the stream retrieves the characters in the reverse
|
|
-order that they were pushed.
|
|
+@Theglibc{} supports pushing back multiple characters; subsequently
|
|
+reading from the stream retrieves the characters in the reverse order
|
|
+that they were pushed.
|
|
|
|
Pushing back characters doesn't alter the file; only the internal
|
|
buffering for the stream is affected. If a file positioning function
|
|
diff --git a/stdio-common/tst-ungetc.c b/stdio-common/tst-ungetc.c
|
|
index 5c808f073419f00b..388b202493ddd586 100644
|
|
--- a/stdio-common/tst-ungetc.c
|
|
+++ b/stdio-common/tst-ungetc.c
|
|
@@ -48,6 +48,8 @@ do_test (void)
|
|
TEST_VERIFY_EXIT (getc (fp) == 'b');
|
|
TEST_VERIFY_EXIT (getc (fp) == 'l');
|
|
TEST_VERIFY_EXIT (ungetc ('m', fp) == 'm');
|
|
+ TEST_VERIFY_EXIT (ungetc ('n', fp) == 'n');
|
|
+ TEST_VERIFY_EXIT (getc (fp) == 'n');
|
|
TEST_VERIFY_EXIT (getc (fp) == 'm');
|
|
TEST_VERIFY_EXIT ((c = getc (fp)) == 'a');
|
|
TEST_VERIFY_EXIT (getc (fp) == EOF);
|