From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/13963 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Szabolcs Nagy Newsgroups: gmane.linux.lib.musl.general Subject: Re: segfault on sscanf Date: Thu, 14 Mar 2019 14:29:21 +0100 Message-ID: <20190314132921.GI26605@port70.net> References: <20190314104617.711ac7d8@faultier2go> <7B2780E2-36BF-4D23-8556-FA138B227CD1@adelielinux.org> Reply-To: musl@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="181884"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Mutt/1.10.1 (2018-07-13) Cc: Natanael ncopa Copa , Marian Buschsieweke To: musl@lists.openwall.com Original-X-From: musl-return-13979-gllmg-musl=m.gmane.org@lists.openwall.com Thu Mar 14 14:29:37 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.89) (envelope-from ) id 1h4QQS-000l8e-0a for gllmg-musl@m.gmane.org; Thu, 14 Mar 2019 14:29:36 +0100 Original-Received: (qmail 11775 invoked by uid 550); 14 Mar 2019 13:29:33 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 11752 invoked from network); 14 Mar 2019 13:29:33 -0000 Mail-Followup-To: musl@lists.openwall.com, Natanael ncopa Copa , Marian Buschsieweke Content-Disposition: inline In-Reply-To: <7B2780E2-36BF-4D23-8556-FA138B227CD1@adelielinux.org> Xref: news.gmane.org gmane.linux.lib.musl.general:13963 Archived-At: * A. Wilcox [2019-03-14 07:44:55 -0500]: > On Mar 14, 2019, at 4:46 AM, Marian Buschsieweke wrote: > > running pdflatex on Alpine Linux for a specific document resulted in a > > segfault, which I could trace down to a specific call to sscanf. This is a > > minimum example to reproduce that segfault: > > > > #include > > > > int main(void) { > > const char *too_parse = "0 1 -1 0"; > > double f1,f2,f3,f4; > > char dummy; > > sscanf(too_parse, " %lf %lf %lf %lf %c", &f1, &f2, &f3, &f4, &dummy); > > > > printf("f1=%f, f2=%f, f3=%f, f4=%f, dummy=\"%c\"\n", f1, f2, f3, f4, dummy); > > > > return 0; > > } > > > > This is the backtrace: > > > > #0 0x00007ffff7fb7eba in vfscanf (f=f@entry=0x7fffffffe6f8, > > fmt=, ap=ap@entry=0x7fffffffe7f8) at src/stdio/vfscanf.c:262 > > #1 0x00007ffff7fb971a in vsscanf (s=, fmt=, > > ap=ap@entry=0x7fffffffe7f8) at src/stdio/vsscanf.c:14 > > #2 0x00007ffff7fb594d in sscanf (s=, fmt=) > > at src/stdio/sscanf.c:9 > > #3 0x0000555555555213 in main () at test.c:7 > > > > I have the package Alpine Linux package musl-1.1.21-r0 installed, which is musl > > version 1.1.21 with minimal changes. > > > > Kind regards, > > Marian > > Hi Marian, > > In your example you have four fields, but sscanf is looking for five. You have run off the end of the string. This is illegal/UB. Is this intentional in your test case? the example does not look undefined to me. 7.21.6.7p3 The sscanf function returns the value of the macro EOF if an input failure occurs before the first conversion (if any) has completed. Otherwise, the sscanf function returns the number of input items assigned, which can be fewer than provided for, or even zero, in the event of an early matching failure. invalid format specifier, invalid argument type or overflow during conversion would be undefined, but input parsing error is not.