This is the mail archive of the
libstdc++@gcc.gnu.org
mailing list for the libstdc++ project.
[v3] Fix money_get::do_get(..., long double&) buffer size
- From: Paolo Carlini <pcarlini at suse dot de>
- To: gcc-patches at gcc dot gnu dot org
- Cc: libstdc++ at gcc dot gnu dot org
- Date: Sat, 25 Oct 2003 00:48:13 +0200
- Subject: [v3] Fix money_get::do_get(..., long double&) buffer size
Hi,
this was a pretty serious bug, with potential security
implications, pretty easy to fix, however (*)
Luckily, the monetary facets are still not in wide use.
I took the occasion to avoid some c_str() in favor of data(),
when '\0' is not really needed: appending it has a cost,
albeit minor.
Tested x86-linux, committed.
Paolo.
(*) Long term, the performance issues of our implementation
should be definitely addressed: at minimum, we must speed
up 'narrow' as suggested by Martin a while ago...
//////////
2003-10-24 Paolo Carlini <pcarlini@suse.de>
* include/bits/locale_facets.tcc (money_get::do_get(...,
long double&): Properly size the temporary buffer.
* testsuite/22_locale/money_get/get/char/11.cc: New.
* testsuite/22_locale/money_get/get/wchar_t/11.cc: Ditto.
* include/bits/locale_facets.tcc (num_put::_M_group_int,
num_put::_M_group_float, money_put::do_put(..., const
string_type&), collate::do_compare, collate::do_transform):
Prefer basic_string::data() to c_str() when the '\0'
terminator is not really needed.
diff -urN libstdc++-v3-orig/include/bits/locale_facets.tcc libstdc++-v3/include/bits/locale_facets.tcc
--- libstdc++-v3-orig/include/bits/locale_facets.tcc 2003-10-24 21:51:22.000000000 +0200
+++ libstdc++-v3/include/bits/locale_facets.tcc 2003-10-25 00:26:55.000000000 +0200
@@ -795,8 +795,8 @@
__new[1] = __cs[1];
}
_CharT* __p;
- __p = std::__add_grouping(__new + __off, __sep, __grouping.c_str(),
- __grouping.c_str() + __grouping.size(),
+ __p = std::__add_grouping(__new + __off, __sep, __grouping.data(),
+ __grouping.data() + __grouping.size(),
__cs + __off, __cs + __len);
__len = __p - __new;
}
@@ -866,8 +866,8 @@
// Add grouping, if necessary.
_CharT* __p2;
const int __declen = __p ? __p - __cs : __len;
- __p2 = std::__add_grouping(__new, __sep, __grouping.c_str(),
- __grouping.c_str() + __grouping.size(),
+ __p2 = std::__add_grouping(__new, __sep, __grouping.data(),
+ __grouping.data() + __grouping.size(),
__cs, __cs + __declen);
// Tack on decimal part.
@@ -1117,12 +1117,12 @@
string_type __str;
__beg = this->do_get(__beg, __end, __intl, __io, __err, __str);
- const int __n = numeric_limits<long double>::digits10;
- char* __cs = static_cast<char*>(__builtin_alloca(__n));
+ const int __cs_size = __str.size() + 1;
+ char* __cs = static_cast<char*>(__builtin_alloca(__cs_size));
const locale __loc = __io.getloc();
const ctype<_CharT>& __ctype = use_facet<ctype<_CharT> >(__loc);
const _CharT* __wcs = __str.c_str();
- __ctype.narrow(__wcs, __wcs + __str.size() + 1, char(), __cs);
+ __ctype.narrow(__wcs, __wcs + __cs_size, char(), __cs);
std::__convert_to_v(__cs, __units, __err, _S_get_c_locale());
return __beg;
}
@@ -1457,7 +1457,7 @@
{
const char_type __sep = __intl ? __mpt.thousands_sep()
: __mpf.thousands_sep();
- const char* __gbeg = __grouping.c_str();
+ const char* __gbeg = __grouping.data();
const char* __gend = __gbeg + __grouping.size();
const int __n = (__end - __beg) * 2;
_CharT* __ws2 =
@@ -1530,7 +1530,7 @@
}
// Write resulting, fully-formatted string to output iterator.
- __s = std::__write(__s, __res.c_str(), __len);
+ __s = std::__write(__s, __res.data(), __len);
}
__io.width(0);
return __s;
@@ -2101,9 +2101,9 @@
const string_type __two(__lo2, __hi2);
const _CharT* __p = __one.c_str();
- const _CharT* __pend = __one.c_str() + __one.length();
+ const _CharT* __pend = __one.data() + __one.length();
const _CharT* __q = __two.c_str();
- const _CharT* __qend = __two.c_str() + __two.length();
+ const _CharT* __qend = __two.data() + __two.length();
// strcoll stops when it sees a nul character so we break
// the strings into zero-terminated substrings and pass those
@@ -2137,7 +2137,7 @@
string_type __str(__lo, __hi);
const _CharT* __p = __str.c_str();
- const _CharT* __pend = __str.c_str() + __str.length();
+ const _CharT* __pend = __str.data() + __str.length();
size_t __len = (__hi - __lo) * 2;
diff -urN libstdc++-v3-orig/testsuite/22_locale/money_get/get/char/11.cc libstdc++-v3/testsuite/22_locale/money_get/get/char/11.cc
--- libstdc++-v3-orig/testsuite/22_locale/money_get/get/char/11.cc 1970-01-01 01:00:00.000000000 +0100
+++ libstdc++-v3/testsuite/22_locale/money_get/get/char/11.cc 2003-10-25 00:00:47.000000000 +0200
@@ -0,0 +1,63 @@
+// 2003-10-24 Paolo Carlini <pcarlini@suse.de>
+
+// Copyright (C) 2003 Free Software Foundation
+//
+// This file is part of the GNU ISO C++ Library. This library is free
+// software; you can redistribute it and/or modify it under the
+// terms of the GNU General Public License as published by the
+// Free Software Foundation; either version 2, or (at your option)
+// any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License along
+// with this library; see the file COPYING. If not, write to the Free
+// Software Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307,
+// USA.
+
+// 22.2.6.1.1 money_get members
+
+#include <locale>
+#include <sstream>
+#include <limits>
+#include <testsuite_hooks.h>
+
+void test01()
+{
+ using namespace std;
+ typedef istreambuf_iterator<char> iterator_type;
+
+ bool test __attribute__((unused)) = true;
+
+ // basic construction
+ locale loc_de = __gnu_test::try_named_locale("de_DE@euro");
+
+ iterator_type end;
+ istringstream iss;
+ iss.imbue(loc_de);
+
+ // cache the money_get facet
+ const money_get<char>& mon_get = use_facet<money_get<char> >(iss.getloc());
+
+ // A _very_ big amount.
+ string str = "1";
+ for (int i = 0; i < 2 * numeric_limits<long double>::digits10; ++i)
+ str += ".000";
+ str += ",00 ";
+
+ iss.str(str);
+ iterator_type is_it01(iss);
+ long double result1;
+ ios_base::iostate err01 = ios_base::goodbit;
+ mon_get.get(is_it01, end, true, iss, err01, result1);
+ VERIFY( err01 == ios_base::eofbit );
+}
+
+int main()
+{
+ test01();
+ return 0;
+}
diff -urN libstdc++-v3-orig/testsuite/22_locale/money_get/get/wchar_t/11.cc libstdc++-v3/testsuite/22_locale/money_get/get/wchar_t/11.cc
--- libstdc++-v3-orig/testsuite/22_locale/money_get/get/wchar_t/11.cc 1970-01-01 01:00:00.000000000 +0100
+++ libstdc++-v3/testsuite/22_locale/money_get/get/wchar_t/11.cc 2003-10-25 00:23:42.000000000 +0200
@@ -0,0 +1,63 @@
+// 2003-10-24 Paolo Carlini <pcarlini@suse.de>
+
+// Copyright (C) 2003 Free Software Foundation
+//
+// This file is part of the GNU ISO C++ Library. This library is free
+// software; you can redistribute it and/or modify it under the
+// terms of the GNU General Public License as published by the
+// Free Software Foundation; either version 2, or (at your option)
+// any later version.
+
+// This library is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License along
+// with this library; see the file COPYING. If not, write to the Free
+// Software Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307,
+// USA.
+
+// 22.2.6.1.1 money_get members
+
+#include <locale>
+#include <sstream>
+#include <limits>
+#include <testsuite_hooks.h>
+
+void test01()
+{
+ using namespace std;
+ typedef istreambuf_iterator<wchar_t> iterator_type;
+
+ bool test __attribute__((unused)) = true;
+
+ // basic construction
+ locale loc_de = __gnu_test::try_named_locale("de_DE@euro");
+
+ iterator_type end;
+ wistringstream iss;
+ iss.imbue(loc_de);
+
+ // cache the money_get facet
+ const money_get<wchar_t>& mon_get = use_facet<money_get<wchar_t> >(iss.getloc());
+
+ // A _very_ big amount.
+ wstring str = L"1";
+ for (int i = 0; i < 2 * numeric_limits<long double>::digits10; ++i)
+ str += L".000";
+ str += L",00 ";
+
+ iss.str(str);
+ iterator_type is_it01(iss);
+ long double result1;
+ ios_base::iostate err01 = ios_base::goodbit;
+ mon_get.get(is_it01, end, true, iss, err01, result1);
+ VERIFY( err01 == ios_base::eofbit );
+}
+
+int main()
+{
+ test01();
+ return 0;
+}