diff options
| author | Rich Felker <dalias@aerifal.cx> | 2020-04-17 13:46:57 -0400 |
|---|---|---|
| committer | Rich Felker <dalias@aerifal.cx> | 2020-04-17 15:19:05 -0400 |
| commit | b287cd745c2243f8e5114331763a5a9813b5f6ee (patch) | |
| tree | 860dca24a3505f530ea0a3e9161895c96b2ab468 | |
| parent | 19f870c3a68a959c7c6ef1de12086ac908920e5e (diff) | |
| download | musl-b287cd745c2243f8e5114331763a5a9813b5f6ee.tar.gz | |
fix undefined behavior in scanf core
as reported/analyzed by Pascal Cuoq, the shlim and shcnt
macros/functions are called by the scanf core (vfscanf) with f->rpos
potentially null (if the FILE is not yet activated for reading at the
time of the call). in this case, they compute differences between a
null pointer (f->rpos) and a non-null one (f->buf), resulting in
undefined behavior.
it's unlikely that any observably wrong behavior occurred in practice,
at least without LTO, due to limits on what's visible to the compiler
from translation unit boundaries, but this has not been checked.
fix is simply ensuring that the FILE is activated for read mode before
entering the main scanf loop, and erroring out early if it can't be.
| -rw-r--r-- | src/stdio/vfscanf.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/stdio/vfscanf.c b/src/stdio/vfscanf.c index 9e030fc4..b5ebc16e 100644 --- a/src/stdio/vfscanf.c +++ b/src/stdio/vfscanf.c @@ -76,6 +76,9 @@ int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap) FLOCK(f); + if (!f->rpos) __toread(f); + if (!f->rpos) goto input_fail; + for (p=(const unsigned char *)fmt; *p; p++) { alloc = 0; |