[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260805182753.GS27423@brightrain.aerifal.cx>
Date: Wed, 5 Aug 2026 14:27:54 -0400
From: Rich Felker <dalias@...c.org>
To: Matthias Goergens <matthias.goergens@...il.com>
Cc: musl@...ts.openwall.com
Subject: Re: [PATCH] stdio: avoid invalid pointer arithmetic in fputwc
On Wed, Aug 05, 2026 at 03:51:49PM +0800, Matthias Goergens wrote:
> Fresh writable streams use null wpos and wend pointers until output is
> initialized. The non-ASCII path adds MB_LEN_MAX to wpos before comparing
> it with wend, which is invalid for a null pointer. The addition can also
> form a pointer beyond one past the buffer when little space remains.
>
> First require an active output buffer. Then compare the defined
> difference between its pointers. Preserve the existing strict capacity
> test and use the normal write fallback otherwise.
> ---
> src/stdio/fputwc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/stdio/fputwc.c b/src/stdio/fputwc.c
> index 789fe9c9..1559bca4 100644
> --- a/src/stdio/fputwc.c
> +++ b/src/stdio/fputwc.c
> @@ -15,7 +15,7 @@ wint_t __fputwc_unlocked(wchar_t c, FILE *f)
>
> if (isascii(c)) {
> c = putc_unlocked(c, f);
> - } else if (f->wpos + MB_LEN_MAX < f->wend) {
> + } else if (f->wpos && f->wend - f->wpos > MB_LEN_MAX) {
> l = wctomb((void *)f->wpos, c);
> if (l < 0) c = WEOF;
> else f->wpos += l;
> --
> 2.55.0
Thanks! This was fixed for non-wide interfaces way back in commit
849e7603e9004fd292a93df64dd3524025f2987a (2018) but apparently the
wide version was missed.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
