Bug 23953 - using stringstreams causes crashes with some locales
Summary: using stringstreams causes crashes with some locales
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: libstdc++ (show other bugs)
Version: 3.4.4
: P2 normal
Target Milestone: 4.0.3
Assignee: Not yet assigned to anyone
URL:
Keywords:
: 25807 26263 (view as bug list)
Depends on:
Blocks:
 
Reported: 2005-09-18 16:24 UTC by plors
Modified: 2006-02-13 17:27 UTC (History)
3 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2005-09-18 17:31:29


Attachments
test.cc (105 bytes, text/plain)
2005-09-18 16:25 UTC, plors
Details
test.ii (92.02 KB, text/plain)
2005-09-18 16:45 UTC, plors
Details

Note You need to log in before you can comment on or make changes to this bug.
Description plors 2005-09-18 16:24:05 UTC
The attached codesnippet (test.cc) will segfault when using the nl_BE locale.
Although i can't confirm it i have heard it migth also fail with some other locales.

------------------------------------
$ g++ -v -save-temps test.cc
Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/specs
Configured with: /var/tmp/portage/gcc-3.4.4-r1/work/gcc-3.4.4/configure
--prefix=/usr --bindir=/usr/i686-pc-linux-gnu/gcc-bin/3.4.4
--includedir=/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/include
--datadir=/usr/share/gcc-data/i686-pc-linux-gnu/3.4.4
--mandir=/usr/share/gcc-data/i686-pc-linux-gnu/3.4.4/man
--infodir=/usr/share/gcc-data/i686-pc-linux-gnu/3.4.4/info
--with-gxx-include-dir=/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/include/g++-v3
--host=i686-pc-linux-gnu --build=i686-pc-linux-gnu --disable-altivec
--enable-nls --without-included-gettext --with-system-zlib --disable-checking
--disable-werror --disable-libunwind-exceptions --disable-multilib
--disable-libgcj --enable-languages=c,c++ --enable-shared --enable-threads=posix
--enable-__cxa_atexit --enable-clocale=gnu
Thread model: posix
gcc version 3.4.4 (Gentoo 3.4.4-r1, ssp-3.4.4-1.0, pie-8.7.8)
 /usr/libexec/gcc/i686-pc-linux-gnu/3.4.4/cc1plus -E -quiet -v -D_GNU_SOURCE
test.cc -mtune=pentiumpro -o test.ii
ignoring nonexistent directory "/usr/local/include"
ignoring nonexistent directory
"/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/../../../../i686-pc-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/include/g++-v3
 /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/include/g++-v3/i686-pc-linux-gnu
 /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/include/g++-v3/backward
 /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/include
 /usr/include
End of search list.
 /usr/libexec/gcc/i686-pc-linux-gnu/3.4.4/cc1plus -fpreprocessed test.ii -quiet
-dumpbase test.cc -mtune=pentiumpro -auxbase test -version -o test.s
GNU C++ version 3.4.4 (Gentoo 3.4.4-r1, ssp-3.4.4-1.0, pie-8.7.8)
(i686-pc-linux-gnu)
        compiled by GNU C version 3.4.3-20050110 (Gentoo Linux
3.4.3.20050110-r2, ssp-3.4.3.20050110-0, pie-8.7.7).
GGC heuristics: --param ggc-min-expand=90 --param ggc-min-heapsize=113194
 /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/../../../../i686-pc-linux-gnu/bin/as -V
-Qy -o test.o test.s
GNU assembler version 2.15.92.0.2 (i686-pc-linux-gnu) using BFD version
2.15.92.0.2 20040927
 /usr/libexec/gcc/i686-pc-linux-gnu/3.4.4/collect2 --eh-frame-hdr -m elf_i386
-dynamic-linker /lib/ld-linux.so.2
/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/../../../crt1.o
/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/../../../crti.o
/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/crtbegin.o
-L/usr/lib/gcc/i686-pc-linux-gnu/3.4.4 -L/usr/lib/gcc/i686-pc-linux-gnu/3.4.4
-L/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/../../../../i686-pc-linux-gnu/lib
-L/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/../../.. test.o -lstdc++ -lm -lgcc_s
-lgcc -lc -lgcc_s -lgcc /usr/lib/gcc/i686-pc-linux-gnu/3.4.4/crtend.o
/usr/lib/gcc/i686-pc-linux-gnu/3.4.4/../../../crtn.o
---------------------------------------------------------------------------

--------------------------------
$ LC_ALL=C ./a.out
$

$ LC_ALL=nl_BE ./a.out
Segmentation fault
--------------------------------------
Comment 1 plors 2005-09-18 16:25:34 UTC
Created attachment 9770 [details]
test.cc
Comment 2 plors 2005-09-18 16:45:05 UTC
Created attachment 9771 [details]
test.ii
Comment 3 Andrew Pinski 2005-09-18 17:02:38 UTC
The stack is overflowed because it is an infinite loop.
Comment 4 Paolo Carlini 2005-09-18 17:31:28 UTC
It looks like we are not considering some special corner cases for the localedata
in numeric_members.cc: as long as *nl_langinfo_l(THOUSANDS_SEP) != '\0' we simply
process the nl_langinfo_l(GROUPING) string as-is. We should be more careful...
Comment 5 Paolo Carlini 2005-09-18 17:42:32 UTC
Probably the best fix is in __add_grouping: we have to consider the possibility
than an integer specifying the group size is -1, which means no more groupings
(section 7. Locale of IEEE Std 1003.1, 2004 Edition)
Comment 6 GCC Commits 2005-09-30 08:41:59 UTC
Subject: Bug 23953

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	paolo@gcc.gnu.org	2005-09-30 08:39:57

Modified files:
	libstdc++-v3   : ChangeLog 
	libstdc++-v3/include/bits: locale_facets.tcc 
Added files:
	libstdc++-v3/testsuite/22_locale/num_get/get/char: 23953.cc 
	libstdc++-v3/testsuite/22_locale/num_get/get/wchar_t: 23953.cc 
	libstdc++-v3/testsuite/22_locale/num_put/put/char: 23953.cc 
	libstdc++-v3/testsuite/22_locale/num_put/put/wchar_t: 23953.cc 

Log message:
	2005-09-30  Paolo Carlini  <pcarlini@suse.de>
	
	PR libstdc++/23953
	* include/bits/locale_facets.tcc (__numpunct_cache<>::_M_cache,
	__moneypunct_cache<>::_M_cache): Check that grouping()[0] > 0.
	(__verify_grouping): Do the last check only if __grouping[__min] > 0.
	(__add_grouping<>): End recursion if *__gbeg <= 0.
	* testsuite/22_locale/num_get/get/char/23953.cc: New.
	* testsuite/22_locale/num_get/get/wchar_t/23953.cc: Likewise.
	* testsuite/22_locale/num_put/put/char/23953.cc: Likewise.
	* testsuite/22_locale/num_put/put/wchar_t/23953.cc: Likewise.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/ChangeLog.diff?cvsroot=gcc&r1=1.3115&r2=1.3116
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/include/bits/locale_facets.tcc.diff?cvsroot=gcc&r1=1.218&r2=1.219
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/testsuite/22_locale/num_get/get/char/23953.cc.diff?cvsroot=gcc&r1=NONE&r2=1.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/testsuite/22_locale/num_get/get/wchar_t/23953.cc.diff?cvsroot=gcc&r1=NONE&r2=1.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/testsuite/22_locale/num_put/put/char/23953.cc.diff?cvsroot=gcc&r1=NONE&r2=1.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/libstdc++-v3/testsuite/22_locale/num_put/put/wchar_t/23953.cc.diff?cvsroot=gcc&r1=NONE&r2=1.1

Comment 7 paolo@gcc.gnu.org 2005-11-06 01:12:27 UTC
Subject: Bug 23953

Author: paolo
Date: Sun Nov  6 01:12:23 2005
New Revision: 106553

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=106553
Log:
2005-11-05  Paolo Carlini  <pcarlini@suse.de>

	PR libstdc++/23953
	* include/bits/locale_facets.tcc (__numpunct_cache<>::_M_cache,
	__moneypunct_cache<>::_M_cache): Check that grouping()[0] > 0.
	(__verify_grouping): Do the last check only if __grouping[__min] > 0.
	(__add_grouping<>): End recursion if *__gbeg <= 0.
	* testsuite/22_locale/num_get/get/char/23953.cc: New.
	* testsuite/22_locale/num_get/get/wchar_t/23953.cc: Likewise.
	* testsuite/22_locale/num_put/put/char/23953.cc: Likewise.
	* testsuite/22_locale/num_put/put/wchar_t/23953.cc: Likewise.

Added:
    branches/gcc-4_0-branch/libstdc++-v3/testsuite/22_locale/num_get/get/char/23953.cc
    branches/gcc-4_0-branch/libstdc++-v3/testsuite/22_locale/num_get/get/wchar_t/23953.cc
    branches/gcc-4_0-branch/libstdc++-v3/testsuite/22_locale/num_put/put/char/23953.cc
    branches/gcc-4_0-branch/libstdc++-v3/testsuite/22_locale/num_put/put/wchar_t/23953.cc
Modified:
    branches/gcc-4_0-branch/libstdc++-v3/ChangeLog
    branches/gcc-4_0-branch/libstdc++-v3/include/bits/locale_facets.tcc

Comment 8 Paolo Carlini 2005-11-06 01:13:25 UTC
Fixed for 4.0.3.
Comment 9 Paolo Carlini 2005-11-06 01:13:45 UTC
Oops...
Comment 10 Paolo Carlini 2006-01-16 13:55:10 UTC
*** Bug 25807 has been marked as a duplicate of this bug. ***
Comment 11 Andrew Pinski 2006-02-13 17:27:34 UTC
*** Bug 26263 has been marked as a duplicate of this bug. ***