procyberian/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

libstdc++: Rewrite __moneypunct_cache::_M_cache [PR104966]

Browse source 
GCC thinks the following can lead to a buffer overflow when __ns.size()
equals zero:

	  const basic_string<_CharT>& __ns = __mp.negative_sign();
	  _M_negative_sign_size = __ns.size();
	  __negative_sign = new _CharT[_M_negative_sign_size];
	  __ns.copy(__negative_sign, _M_negative_sign_size);

This happens because operator new might be replaced with something that
writes to this->_M_negative_sign_size and so the basic_string::copy call
could use a non-zero size to write to a zero-length buffer.

The solution suggested by Richi is to cache the size in a local variable
so that the compiler knows it won't be changed between the allocation
and the copy.

This commit goes further and rewrites the whole function to use RAII and
delay all modifications of *this until after all allocations have
succeeded. The RAII helper type caches the size and copies the string
and owns the memory until told to release it.

libstdc++-v3/ChangeLog:

	PR middle-end/104966
	* include/bits/locale_facets_nonio.tcc
	(__moneypunct_cache::_M_cache): Replace try-catch with RAII and
	make all string copies before any stores to *this.
This commit is contained in:
Jonathan Wakely 2022-03-17 13:33:07 +00:00
parent 1d47c0512a
commit 38ce448963
1 changed files with 50 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

100
libstdc++-v3/include/bits/locale_facets_nonio.tcc
View file

@ -71,61 +71,61 @@ _GLIBCXX_BEGIN_NAMESPACE_VERSION
const moneypunct<_CharT, _Intl>& __mp =
use_facet<moneypunct<_CharT, _Intl> >(__loc);
struct _Scoped_str
{
size_t _M_len;
_CharT* _M_str;
explicit
_Scoped_str(const basic_string<_CharT>& __str)
: _M_len(__str.size()), _M_str(new _CharT[_M_len])
{ __str.copy(_M_str, _M_len); }
~_Scoped_str() { delete[] _M_str; }
void
_M_release(const _CharT*& __p, size_t& __n)
{
__p = _M_str;
__n = _M_len;
_M_str = 0;
}
};
_Scoped_str __curr_symbol(__mp.curr_symbol());
_Scoped_str __positive_sign(__mp.positive_sign());
_Scoped_str __negative_sign(__mp.negative_sign());
const string& __g = __mp.grouping();
const size_t __g_size = __g.size();
char* const __grouping = new char[__g_size];
__g.copy(__grouping, __g_size);
// All allocations succeeded without throwing, OK to modify *this now.
_M_grouping = __grouping;
_M_grouping_size = __g_size;
_M_use_grouping = (__g_size
&& static_cast<signed char>(__grouping[0]) > 0
&& (__grouping[0]
!= __gnu_cxx::__numeric_traits<char>::__max));
_M_decimal_point = __mp.decimal_point();
_M_thousands_sep = __mp.thousands_sep();
__curr_symbol._M_release(_M_curr_symbol, _M_curr_symbol_size);
__positive_sign._M_release(_M_positive_sign, _M_positive_sign_size);
__negative_sign._M_release(_M_negative_sign, _M_negative_sign_size);
_M_frac_digits = __mp.frac_digits();
_M_pos_format = __mp.pos_format();
_M_neg_format = __mp.neg_format();
char* __grouping = 0;
_CharT* __curr_symbol = 0;
_CharT* __positive_sign = 0;
_CharT* __negative_sign = 0;
__try
{
const string& __g = __mp.grouping();
_M_grouping_size = __g.size();
__grouping = new char[_M_grouping_size];
__g.copy(__grouping, _M_grouping_size);
_M_use_grouping = (_M_grouping_size
&& static_cast<signed char>(__grouping[0]) > 0
&& (__grouping[0]
!= __gnu_cxx::__numeric_traits<char>::__max));
const ctype<_CharT>& __ct = use_facet<ctype<_CharT> >(__loc);
__ct.widen(money_base::_S_atoms,
money_base::_S_atoms + money_base::_S_end, _M_atoms);
const basic_string<_CharT>& __cs = __mp.curr_symbol();
_M_curr_symbol_size = __cs.size();
__curr_symbol = new _CharT[_M_curr_symbol_size];
__cs.copy(__curr_symbol, _M_curr_symbol_size);
const basic_string<_CharT>& __ps = __mp.positive_sign();
_M_positive_sign_size = __ps.size();
__positive_sign = new _CharT[_M_positive_sign_size];
__ps.copy(__positive_sign, _M_positive_sign_size);
const basic_string<_CharT>& __ns = __mp.negative_sign();
_M_negative_sign_size = __ns.size();
__negative_sign = new _CharT[_M_negative_sign_size];
__ns.copy(__negative_sign, _M_negative_sign_size);
_M_pos_format = __mp.pos_format();
_M_neg_format = __mp.neg_format();
const ctype<_CharT>& __ct = use_facet<ctype<_CharT> >(__loc);
__ct.widen(money_base::_S_atoms,
money_base::_S_atoms + money_base::_S_end, _M_atoms);
_M_grouping = __grouping;
_M_curr_symbol = __curr_symbol;
_M_positive_sign = __positive_sign;
_M_negative_sign = __negative_sign;
_M_allocated = true;
}
__catch(...)
{
delete [] __grouping;
delete [] __curr_symbol;
delete [] __positive_sign;
delete [] __negative_sign;
__throw_exception_again;
}
_M_allocated = true;
}
_GLIBCXX_BEGIN_NAMESPACE_LDBL_OR_CXX11