libs/newlib-cygwin
libs
/
newlib-cygwin
mirror of git://sourceware.org/git/newlib-cygwin.git
4
0
Fork 0
Code Issues Projects Releases Wiki Activity

Don't overread or write memory returned by _DTOA_R 

Don't over-read memory returned by _DTOA_R, and never write to it
since the result might be a string literal.

For example, when doing:
  swprintf(tt, 20, L"%.*f", 6, 0.0);

we will get back "0".

Instead, write the result returned by _DTOA_R to the output buffer.
After this, write the 0 chars directly to the the output buffer
(if there are any). This also has the (marginal) advantage that
we read/write less memory overall.
This commit is contained in:
Silviu Baranga 2017-06-05 09:54:42 +01:00 committed by Corinna Vinschen
parent 5562000225
commit efaef1bba2
1 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
newlib/libc/stdio/vfwprintf.c
View File

@ -1631,12 +1631,18 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags,
{ {
char *digits, *bp, *rve; char *digits, *bp, *rve;
#ifndef _MB_CAPABLE
int i; int i;
#endif
digits = _DTOA_R (data, value, mode, ndigits, decpt, &dsgn, &rve); digits = _DTOA_R (data, value, mode, ndigits, decpt, &dsgn, &rve);
#ifdef _MB_CAPABLE
_mbsnrtowcs_r (data, buf, (const char **) &digits, rve - digits,
len, NULL);
#else
for (i = 0; i < rve - digits && i < len; ++i)
buf[i] = (wchar_t) digits[i];
#endif
if ((ch != L'g' && ch != L'G') || flags & ALT) { /* Print trailing zeros */ if ((ch != L'g' && ch != L'G') || flags & ALT) { /* Print trailing zeros */
bp = digits + ndigits; bp = digits + ndigits;
if (ch == L'f' || ch == L'F') { if (ch == L'f' || ch == L'F') {
@ -1646,18 +1652,13 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags,
} }
if (value == 0) /* kludge for __dtoa irregularity */ if (value == 0) /* kludge for __dtoa irregularity */
rve = bp; rve = bp;
while (rve < bp)
*rve++ = '0';
}
for (i = rve - digits; i < bp - digits && i < len; ++i)
buf[i] = L'0';
rve = rve > bp ? rve : bp;
}
*length = rve - digits; /* full length of the string */ *length = rve - digits; /* full length of the string */
#ifdef _MB_CAPABLE
_mbsnrtowcs_r (data, buf, (const char **) &digits, *length,
len, NULL);
#else
for (i = 0; i < *length && i < len; ++i)
buf[i] = (wchar_t) digits[i];
#endif
return buf; return buf;
} }
} }