about summary refs log tree commit diff
path: root/libio/tst_swprintf.c
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2022-12-19 18:56:55 +0100
committerFlorian Weimer <fweimer@redhat.com>2022-12-19 18:56:55 +0100
commit118816de3383ff12769349784689141355cc787c (patch)
treefa858eff7a21613e38e532ac9c1d0edd1651aeab /libio/tst_swprintf.c
parent5365acc567a49270b4341b9d325794ec554258d9 (diff)
downloadglibc-118816de3383ff12769349784689141355cc787c.tar.gz
glibc-118816de3383ff12769349784689141355cc787c.tar.xz
glibc-118816de3383ff12769349784689141355cc787c.zip
libio: Convert __vswprintf_internal to buffers (bug 27857)
Always null-terminate the buffer and set E2BIG if the buffer is too
small.  This fixes bug 27857.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
Diffstat (limited to 'libio/tst_swprintf.c')
-rw-r--r--libio/tst_swprintf.c31
1 files changed, 28 insertions, 3 deletions
diff --git a/libio/tst_swprintf.c b/libio/tst_swprintf.c
index 1f997b9393..169951de4b 100644
--- a/libio/tst_swprintf.c
+++ b/libio/tst_swprintf.c
@@ -1,4 +1,5 @@
 #include <array_length.h>
+#include <errno.h>
 #include <stdio.h>
 #include <support/check.h>
 #include <sys/types.h>
@@ -37,6 +38,8 @@ do_test (void)
 
   for (n = 0; n < array_length (tests); ++n)
     {
+      wmemset (buf, 0xabcd, array_length (buf));
+      errno = 0;
       ssize_t res = swprintf (buf, tests[n].n, L"%s", tests[n].str);
 
       if (tests[n].exp < 0 && res >= 0)
@@ -52,9 +55,31 @@ do_test (void)
 swprintf (buf, %zu, L\"%%s\", \"%s\") expected to return %zd, but got %zd\n",
 		  tests[n].n, tests[n].str, tests[n].exp, res);
 	}
-      else
-	printf ("swprintf (buf, %zu, L\"%%s\", \"%s\") OK\n",
-		tests[n].n, tests[n].str);
+      else if (res < 0
+	       && tests[n].n > 0
+	       && wcsnlen (buf, array_length (buf)) == array_length (buf))
+	{
+	  support_record_failure ();
+	  printf ("\
+error: swprintf (buf, %zu, L\"%%s\", \"%s\") missing null terminator\n",
+		  tests[n].n, tests[n].str);
+	}
+      else if (res < 0
+	       && tests[n].n > 0
+	       && wcsnlen (buf, array_length (buf)) < array_length (buf)
+	       && buf[wcsnlen (buf, array_length (buf)) + 1] != 0xabcd)
+	{
+	  support_record_failure ();
+	  printf ("\
+error: swprintf (buf, %zu, L\"%%s\", \"%s\") out of bounds write\n",
+		  tests[n].n, tests[n].str);
+	}
+
+      if (res < 0 && tests[n].n < 0)
+	TEST_COMPARE (errno, E2BIG);
+
+      printf ("swprintf (buf, %zu, L\"%%s\", \"%s\") OK\n",
+	      tests[n].n, tests[n].str);
     }
 
   TEST_COMPARE (swprintf (buf, array_length (buf), L"%.0s", "foo"), 0);