libstdc++/9538: Out-of-bounds memory access in streambuf::sputbackc

[peturr02@ru.is]

>Number:         9538
>Category:       libstdc++
>Synopsis:       Out-of-bounds memory access in streambuf::sputbackc
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Feb 02 11:56:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     peturr02@ru.is
>Release:        gcc-3.2.1
>Organization:
>Environment:
Red Hat Linux 8.0
>Description:
basic_streambuf<>::sputbackc accesses gptr()[-1] without first checking if gptr() > eback(). This can be a fatal error if (gptr() - 1) is not a valid address or if char_type is a class type.
>How-To-Repeat:
See attachment.
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted:
----gnatsweb-attachment----
Content-Type: text/plain; name="sputbackcbug2.cc"
Content-Disposition: inline; filename="sputbackcbug2.cc"

#include <streambuf>

#undef NDEBUG
#include <cassert>

using namespace std;

class MyTraits : public char_traits<char>
{
public:
	static bool eq(char c1, char c2)
		{
			assert(c1 >= 0);
			assert(c2 >= 0);
			return char_traits<char>::eq(c1, c2);
		}
};

class MyBuf : public basic_streambuf<char, MyTraits>
{
	char buffer[8];

public:
	MyBuf()
		{
			memset(buffer, -1, sizeof(buffer));
			memset(buffer + 2, 0, 4);
			setg(buffer + 2, buffer + 2, buffer + 6);
		}
};

int main()
{
	MyBuf mb;
	mb.sputbackc(0);
	return 0;
}