diff options
| author | Andreas Schwab <schwab@suse.de> | 2019-05-14 17:14:59 +0200 |
|---|---|---|
| committer | Andreas Schwab <schwab@suse.de> | 2019-05-15 16:47:09 +0200 |
| commit | 32ff397533715988c19cbf3675dcbd727ec13e18 (patch) | |
| tree | fb529b404d7136b24968ebbf8618af9ea13c7b79 /libio/wfileops.c | |
| parent | a9368c34d70cef91ca59b09941f496df11d6b146 (diff) | |
| download | glibc-32ff397533715988c19cbf3675dcbd727ec13e18.tar.gz glibc-32ff397533715988c19cbf3675dcbd727ec13e18.tar.xz glibc-32ff397533715988c19cbf3675dcbd727ec13e18.zip | |
Fix crash in _IO_wfile_sync (bug 20568)
When computing the length of the converted part of the stdio buffer, use the number of consumed wide characters, not the (negative) distance to the end of the wide buffer.
Diffstat (limited to 'libio/wfileops.c')
| -rw-r--r-- | libio/wfileops.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libio/wfileops.c b/libio/wfileops.c index 0367643703..69fbb62a02 100644 --- a/libio/wfileops.c +++ b/libio/wfileops.c @@ -508,11 +508,12 @@ _IO_wfile_sync (FILE *fp) generate the wide characters up to the current reading position. */ int nread; - + size_t wnread = (fp->_wide_data->_IO_read_ptr + - fp->_wide_data->_IO_read_base); fp->_wide_data->_IO_state = fp->_wide_data->_IO_last_state; nread = (*cv->__codecvt_do_length) (cv, &fp->_wide_data->_IO_state, fp->_IO_read_base, - fp->_IO_read_end, delta); + fp->_IO_read_end, wnread); fp->_IO_read_ptr = fp->_IO_read_base + nread; delta = -(fp->_IO_read_end - fp->_IO_read_base - nread); } |