2016-12-15 Giuseppe Musumeci <giuseppe.musumeci@broadcom.com>

__sinit initialises some common file descriptors as line buffered and
relies on the first users of such FDs to call __smakebuf_r. If
__smakebuf_r realises there's no space for a buffer (malloc returns
NULL), it makes them unbuffered. However, while setting the __SNBF
bit, it doesn't clear the __SLBF bit in the flags. Depending on the
order in which functions check buffering flags in the FD, sometime
they assume it's line buffered (e.g. __sfvwrite_r), trashing
application memory that's not really been allocated to them.

This patch solves the problem by clearing the unbuffered/line buffered
flag when setting the line buffered/unbuffered flag.
This commit is contained in:
Jeff Johnston 2016-12-15 12:06:04 -05:00
parent c549e953a9
commit 05272960ab
1 changed files with 2 additions and 2 deletions

View File

@ -55,7 +55,7 @@ _DEFUN(__smakebuf_r, (ptr, fp),
{ {
if (!(fp->_flags & __SSTR)) if (!(fp->_flags & __SSTR))
{ {
fp->_flags |= __SNBF; fp->_flags = (fp->_flags & ~__SLBF) | __SNBF;
fp->_bf._base = fp->_p = fp->_nbuf; fp->_bf._base = fp->_p = fp->_nbuf;
fp->_bf._size = 1; fp->_bf._size = 1;
} }
@ -67,7 +67,7 @@ _DEFUN(__smakebuf_r, (ptr, fp),
fp->_bf._base = fp->_p = (unsigned char *) p; fp->_bf._base = fp->_p = (unsigned char *) p;
fp->_bf._size = size; fp->_bf._size = size;
if (couldbetty && _isatty_r (ptr, fp->_file)) if (couldbetty && _isatty_r (ptr, fp->_file))
fp->_flags |= __SLBF; fp->_flags = (fp->_flags & ~__SNBF) | __SLBF;
fp->_flags |= flags; fp->_flags |= flags;
} }
} }