aboutsummaryrefslogtreecommitdiffstats
path: root/libio
diff options
context:
space:
mode:
Diffstat (limited to 'libio')
-rw-r--r--libio/iovsprintf.c54
-rw-r--r--libio/libio.h1
-rw-r--r--libio/libioP.h25
3 files changed, 56 insertions, 24 deletions
diff --git a/libio/iovsprintf.c b/libio/iovsprintf.c
index cf4b9973a73..513ca030131 100644
--- a/libio/iovsprintf.c
+++ b/libio/iovsprintf.c
@@ -27,8 +27,47 @@
#include "libioP.h"
#include "strfile.h"
+static int __THROW
+_IO_str_chk_overflow (FILE *fp, int c)
+{
+ /* If we get here, the user-supplied buffer would be overrun by
+ further output. */
+ __chk_fail ();
+}
+
+static const struct _IO_jump_t _IO_str_chk_jumps libio_vtable =
+{
+ JUMP_INIT_DUMMY,
+ JUMP_INIT(finish, _IO_str_finish),
+ JUMP_INIT(overflow, _IO_str_chk_overflow),
+ JUMP_INIT(underflow, _IO_str_underflow),
+ JUMP_INIT(uflow, _IO_default_uflow),
+ JUMP_INIT(pbackfail, _IO_str_pbackfail),
+ JUMP_INIT(xsputn, _IO_default_xsputn),
+ JUMP_INIT(xsgetn, _IO_default_xsgetn),
+ JUMP_INIT(seekoff, _IO_str_seekoff),
+ JUMP_INIT(seekpos, _IO_default_seekpos),
+ JUMP_INIT(setbuf, _IO_default_setbuf),
+ JUMP_INIT(sync, _IO_default_sync),
+ JUMP_INIT(doallocate, _IO_default_doallocate),
+ JUMP_INIT(read, _IO_default_read),
+ JUMP_INIT(write, _IO_default_write),
+ JUMP_INIT(seek, _IO_default_seek),
+ JUMP_INIT(close, _IO_default_close),
+ JUMP_INIT(stat, _IO_default_stat),
+ JUMP_INIT(showmanyc, _IO_default_showmanyc),
+ JUMP_INIT(imbue, _IO_default_imbue)
+};
+
+/* This function is called by regular vsprintf with maxlen set to -1,
+ and by vsprintf_chk with maxlen set to the size of the output
+ string. In the former case, _IO_str_chk_overflow will never be
+ called; in the latter case it will crash the program if the buffer
+ overflows. */
+
int
-__vsprintf_internal (char *string, const char *format, va_list args,
+__vsprintf_internal (char *string, size_t maxlen,
+ const char *format, va_list args,
unsigned int mode_flags)
{
_IO_strfile sf;
@@ -38,17 +77,22 @@ __vsprintf_internal (char *string, const char *format, va_list args,
sf._sbf._f._lock = NULL;
#endif
_IO_no_init (&sf._sbf._f, _IO_USER_LOCK, -1, NULL, NULL);
- _IO_JUMPS (&sf._sbf) = &_IO_str_jumps;
- _IO_str_init_static_internal (&sf, string, -1, string);
+ _IO_JUMPS (&sf._sbf) = &_IO_str_chk_jumps;
+ string[0] = '\0';
+ _IO_str_init_static_internal (&sf, string,
+ (maxlen == -1) ? -1 : maxlen - 1,
+ string);
+
ret = __vfprintf_internal (&sf._sbf._f, format, args, mode_flags);
- _IO_putc_unlocked ('\0', &sf._sbf._f);
+
+ *sf._sbf._f._IO_write_ptr = '\0';
return ret;
}
int
__vsprintf (char *string, const char *format, va_list args)
{
- return __vsprintf_internal (string, format, args, 0);
+ return __vsprintf_internal (string, -1, format, args, 0);
}
ldbl_strong_alias (__vsprintf, _IO_vsprintf)
diff --git a/libio/libio.h b/libio/libio.h
index 1025f3343e6..68dac44635d 100644
--- a/libio/libio.h
+++ b/libio/libio.h
@@ -90,7 +90,6 @@ typedef union
/* Bits for the _flags2 field. */
#define _IO_FLAGS2_MMAP 1
#define _IO_FLAGS2_NOTCANCEL 2
-#define _IO_FLAGS2_FORTIFY 4
#define _IO_FLAGS2_USER_WBUF 8
#define _IO_FLAGS2_NOCLOSE 32
#define _IO_FLAGS2_CLOEXEC 64
diff --git a/libio/libioP.h b/libio/libioP.h
index 17eda383d38..07b60e3e268 100644
--- a/libio/libioP.h
+++ b/libio/libioP.h
@@ -672,8 +672,13 @@ extern int __vdprintf_internal (int d, const char *format, va_list ap,
extern int __obstack_vprintf_internal (struct obstack *ob, const char *fmt,
va_list ap, unsigned int mode_flags);
-extern int __vsprintf_internal (char *string, const char *format, va_list ap,
+/* Note: __vsprintf_internal, unlike vsprintf, does take a maxlen argument,
+ because it's called by both vsprintf and vsprintf_chk. If maxlen is
+ not set to -1, overrunning the buffer will cause a prompt crash. */
+extern int __vsprintf_internal (char *string, size_t maxlen,
+ const char *format, va_list ap,
unsigned int mode_flags);
+
extern int __vsnprintf_internal (char *string, size_t maxlen,
const char *format, va_list ap,
unsigned int mode_flags);
@@ -788,26 +793,10 @@ _IO_acquire_lock_fct (FILE **p)
_IO_funlockfile (fp);
}
-static inline void
-__attribute__ ((__always_inline__))
-_IO_acquire_lock_clear_flags2_fct (FILE **p)
-{
- FILE *fp = *p;
- fp->_flags2 &= ~(_IO_FLAGS2_FORTIFY);
- if ((fp->_flags & _IO_USER_LOCK) == 0)
- _IO_funlockfile (fp);
-}
-
#if !defined _IO_MTSAFE_IO && IS_IN (libc)
# define _IO_acquire_lock(_fp) \
- do { \
- FILE *_IO_acquire_lock_file = NULL
-# define _IO_acquire_lock_clear_flags2(_fp) \
- do { \
- FILE *_IO_acquire_lock_file = (_fp)
+ do {
# define _IO_release_lock(_fp) \
- if (_IO_acquire_lock_file != NULL) \
- _IO_acquire_lock_file->_flags2 &= ~(_IO_FLAGS2_FORTIFY); \
} while (0)
#endif