From 4e2f43f842ef5e253cc23383645adbaa03cedb86 Mon Sep 17 00:00:00 2001 From: Zack Weinberg Date: Wed, 7 Mar 2018 14:32:03 -0500 Subject: Use PRINTF_FORTIFY instead of _IO_FLAGS2_FORTIFY (bug 11319) The _chk variants of all of the printf functions become much simpler. This is the last thing that we needed _IO_acquire_lock_clear_flags2 for, so it can go as well. I took the opportunity to make the headers included and the names of all local variables consistent across all the affected files. Since we ultimately want to get rid of __no_long_double as well, it must be possible to get all of the nontrivial effects of the _chk functions by calling the _internal functions with appropriate flags. For most of the __(v)xprintf_chk functions, this is covered by PRINTF_FORTIFY plus some up-front argument checks that can be duplicated. However, __(v)sprintf_chk installs a custom jump table so that it can crash instead of overflowing the output buffer. This functionality is moved to __vsprintf_internal, which now has a 'maxlen' argument like __vsnprintf_internal; to get the unsafe behavior of ordinary (v)sprintf, pass -1 for that argument. obstack_printf_chk and obstack_vprintf_chk are no longer in the same file. As a side-effect of the unification of both fortified and non-fortified vdprintf initialization, this patch fixes bug 11319 for __dprintf_chk and __vdprintf_chk, which was previously fixed only for dprintf and vdprintf by the commit commit 7ca890b88e6ab7624afb1742a9fffb37ad5b3fc3 Author: Ulrich Drepper Date: Wed Feb 24 16:07:57 2010 -0800 Fix reporting of I/O errors in *dprintf functions. This patch adds a test case to avoid regressions. Tested for powerpc and powerpc64le. --- libio/iovsprintf.c | 54 +++++++++++++++++++++++++++++++++++++++++++++++++----- libio/libio.h | 1 - libio/libioP.h | 27 +++++++++------------------ 3 files changed, 58 insertions(+), 24 deletions(-) (limited to 'libio') diff --git a/libio/iovsprintf.c b/libio/iovsprintf.c index 3b1e8292b5..08e4002625 100644 --- a/libio/iovsprintf.c +++ b/libio/iovsprintf.c @@ -27,8 +27,47 @@ #include "libioP.h" #include "strfile.h" +static int __THROW +_IO_str_chk_overflow (FILE *fp, int c) +{ + /* If we get here, the user-supplied buffer would be overrun by + further output. */ + __chk_fail (); +} + +static const struct _IO_jump_t _IO_str_chk_jumps libio_vtable = +{ + JUMP_INIT_DUMMY, + JUMP_INIT(finish, _IO_str_finish), + JUMP_INIT(overflow, _IO_str_chk_overflow), + JUMP_INIT(underflow, _IO_str_underflow), + JUMP_INIT(uflow, _IO_default_uflow), + JUMP_INIT(pbackfail, _IO_str_pbackfail), + JUMP_INIT(xsputn, _IO_default_xsputn), + JUMP_INIT(xsgetn, _IO_default_xsgetn), + JUMP_INIT(seekoff, _IO_str_seekoff), + JUMP_INIT(seekpos, _IO_default_seekpos), + JUMP_INIT(setbuf, _IO_default_setbuf), + JUMP_INIT(sync, _IO_default_sync), + JUMP_INIT(doallocate, _IO_default_doallocate), + JUMP_INIT(read, _IO_default_read), + JUMP_INIT(write, _IO_default_write), + JUMP_INIT(seek, _IO_default_seek), + JUMP_INIT(close, _IO_default_close), + JUMP_INIT(stat, _IO_default_stat), + JUMP_INIT(showmanyc, _IO_default_showmanyc), + JUMP_INIT(imbue, _IO_default_imbue) +}; + +/* This function is called by regular vsprintf with maxlen set to -1, + and by vsprintf_chk with maxlen set to the size of the output + string. In the former case, _IO_str_chk_overflow will never be + called; in the latter case it will crash the program if the buffer + overflows. */ + int -__vsprintf_internal (char *string, const char *format, va_list args, +__vsprintf_internal (char *string, size_t maxlen, + const char *format, va_list args, unsigned int mode_flags) { _IO_strfile sf; @@ -38,17 +77,22 @@ __vsprintf_internal (char *string, const char *format, va_list args, sf._sbf._f._lock = NULL; #endif _IO_no_init (&sf._sbf._f, _IO_USER_LOCK, -1, NULL, NULL); - _IO_JUMPS (&sf._sbf) = &_IO_str_jumps; - _IO_str_init_static_internal (&sf, string, -1, string); + _IO_JUMPS (&sf._sbf) = &_IO_str_chk_jumps; + string[0] = '\0'; + _IO_str_init_static_internal (&sf, string, + (maxlen == -1) ? -1 : maxlen - 1, + string); + ret = __vfprintf_internal (&sf._sbf._f, format, args, mode_flags); - _IO_putc_unlocked ('\0', &sf._sbf._f); + + *sf._sbf._f._IO_write_ptr = '\0'; return ret; } int __vsprintf (char *string, const char *format, va_list args) { - return __vsprintf_internal (string, format, args, 0); + return __vsprintf_internal (string, -1, format, args, 0); } ldbl_strong_alias (__vsprintf, _IO_vsprintf) diff --git a/libio/libio.h b/libio/libio.h index c188814ccc..3a93807efc 100644 --- a/libio/libio.h +++ b/libio/libio.h @@ -90,7 +90,6 @@ typedef union /* Bits for the _flags2 field. */ #define _IO_FLAGS2_MMAP 1 #define _IO_FLAGS2_NOTCANCEL 2 -#define _IO_FLAGS2_FORTIFY 4 #define _IO_FLAGS2_USER_WBUF 8 #define _IO_FLAGS2_NOCLOSE 32 #define _IO_FLAGS2_CLOEXEC 64 diff --git a/libio/libioP.h b/libio/libioP.h index fe52ef1752..ce5228e382 100644 --- a/libio/libioP.h +++ b/libio/libioP.h @@ -677,9 +677,16 @@ extern int __obstack_vprintf_internal (struct obstack *ob, const char *fmt, va_list ap, unsigned int mode_flags) attribute_hidden; -extern int __vsprintf_internal (char *string, const char *format, va_list ap, +/* Note: __vsprintf_internal, unlike vsprintf, does take a maxlen argument, + because it's called by both vsprintf and vsprintf_chk. If maxlen is + not set to -1, overrunning the buffer will cause a prompt crash. + This is the behavior of ordinary (v)sprintf functions, thus they call + __vsprintf_internal with that argument set to -1. */ +extern int __vsprintf_internal (char *string, size_t maxlen, + const char *format, va_list ap, unsigned int mode_flags) attribute_hidden; + extern int __vsnprintf_internal (char *string, size_t maxlen, const char *format, va_list ap, unsigned int mode_flags) @@ -818,26 +825,10 @@ _IO_acquire_lock_fct (FILE **p) _IO_funlockfile (fp); } -static inline void -__attribute__ ((__always_inline__)) -_IO_acquire_lock_clear_flags2_fct (FILE **p) -{ - FILE *fp = *p; - fp->_flags2 &= ~(_IO_FLAGS2_FORTIFY); - if ((fp->_flags & _IO_USER_LOCK) == 0) - _IO_funlockfile (fp); -} - #if !defined _IO_MTSAFE_IO && IS_IN (libc) # define _IO_acquire_lock(_fp) \ - do { \ - FILE *_IO_acquire_lock_file = NULL -# define _IO_acquire_lock_clear_flags2(_fp) \ - do { \ - FILE *_IO_acquire_lock_file = (_fp) + do { # define _IO_release_lock(_fp) \ - if (_IO_acquire_lock_file != NULL) \ - _IO_acquire_lock_file->_flags2 &= ~(_IO_FLAGS2_FORTIFY); \ } while (0) #endif -- cgit 1.4.1