From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/10338 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: vprintf.c bug Date: Tue, 26 Jul 2016 23:17:00 -0400 Message-ID: <20160727031700.GX15995@brightrain.aerifal.cx> References: Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1469589446 18038 80.91.229.3 (27 Jul 2016 03:17:26 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 27 Jul 2016 03:17:26 +0000 (UTC) Cc: musl@lists.openwall.com To: Jacob Abrams Original-X-From: musl-return-10351-gllmg-musl=m.gmane.org@lists.openwall.com Wed Jul 27 05:17:19 2016 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1bSFLS-00061u-LJ for gllmg-musl@m.gmane.org; Wed, 27 Jul 2016 05:17:18 +0200 Original-Received: (qmail 11959 invoked by uid 550); 27 Jul 2016 03:17:16 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 11940 invoked from network); 27 Jul 2016 03:17:15 -0000 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:10338 Archived-At: On Tue, Jul 26, 2016 at 03:25:40PM -0700, Jacob Abrams wrote: > I believe there is a small bug in vfprintf.c > > I had to change the if statement from > > ret = printf_core(f, fmt, &ap2, nl_arg, nl_type); > if (saved_buf) { > > to > > ret = printf_core(f, fmt, &ap2, nl_arg, nl_type); > if (f->buf == internal_buf) { > > Because the saved_buf may be NULL which will result the internal > buffer being used but the file not being reset properly after the call > to printf_core. This was discovered while using MUSL v1.1.4 on an OS > other than Linux. Where do you get a FILE with a null f->buf? While it's not written down anywhere, that breaks a contract expected several other places in the stdio implementation. If you're trying to use vfprintf.c outside of musl I think you probably need to disable/remove this buffer replacement code, which would be poking at the internals of another stdio implementation in a likely-invalid way. Rich