From 3d110c7c6e6549bd4124fce49cdc672f9e449799 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 11 Oct 2013 22:29:38 +0530 Subject: Fix fwrite() reading beyond end of buffer in error path Partially revert commits 2b766585f9b4ffabeef2f36200c275976b93f2c7 and de2fd463b1c0310d75084b6d774fb974075a4ad9, which were intended to fix BZ#11741 but caused another, likely worse bug, namely that fwrite() and fputs() could, in an error path, read data beyond the end of the specified buffer, and potentially even write this data to the file. Fix BZ#11741 properly by checking the return value from _IO_padn() in stdio-common/vfprintf.c. --- stdio-common/vfprintf.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'stdio-common') diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c index fb22f6969e..8cd7a85b21 100644 --- a/stdio-common/vfprintf.c +++ b/stdio-common/vfprintf.c @@ -90,13 +90,13 @@ do { \ if (width > 0) \ { \ - unsigned int d = _IO_padn (s, (Padchar), width); \ - if (__glibc_unlikely (d == EOF)) \ + _IO_ssize_t written = _IO_padn (s, (Padchar), width); \ + if (__glibc_unlikely (written != width)) \ { \ done = -1; \ goto all_done; \ } \ - done_add (d); \ + done_add (written); \ } \ } while (0) # define PUTC(C, F) _IO_putc_unlocked (C, F) @@ -119,13 +119,13 @@ do { \ if (width > 0) \ { \ - unsigned int d = _IO_wpadn (s, (Padchar), width); \ - if (__glibc_unlikely (d == EOF)) \ + _IO_ssize_t written = _IO_wpadn (s, (Padchar), width); \ + if (__glibc_unlikely (written != width)) \ { \ done = -1; \ goto all_done; \ } \ - done_add (d); \ + done_add (written); \ } \ } while (0) # define PUTC(C, F) _IO_putwc_unlocked (C, F) -- cgit 1.4.1