[Bug libstdc++/14975] New: Segfault on low-level write error during imbue

["peturr02 at ru dot is" <gcc-bugzilla at gcc dot gnu dot org>]

This bit from basic_filebuf::imbue in include/bits/fstream.tcc can't
possibly be correct:

              else if (_M_writing && (__testvalid = _M_terminate_output()))
                _M_set_buffer(-1);
            }
        }

      if (__testvalid)
        _M_codecvt = _M_codecvt_tmp;

If __testvalid is false for some reason (for example because
_M_terminate_output returned false because of a low-level write error),
then _M_codecvt will still point to the codecvt facet from the old locale.

Since no reference is kept to the old locale, the facet may be deleted at
any time, and so keeping a pointer to it is certainly wrong.

-- 
           Summary: Segfault on low-level write error during imbue
           Product: gcc
           Version: 3.4.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libstdc++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: peturr02 at ru dot is
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14975