[PATCH 0/1] libstdc++: Fix SIGSEGV in std::print with a setvbuf'd FILE

[Anlai Lu]

std::print(FILE*, ...) crashes with SIGSEGV when the FILE has a
pre-allocated buffer (via setvbuf) that has never been written.

Root cause: _File_sink::_File::_M_write_buf() returns
{_IO_write_ptr, _IO_buf_end - _IO_write_ptr}.  After setvbuf glibc
pre-allocates the buffer (so _IO_buf_end is valid) but keeps
_IO_write_ptr as nullptr until the first write, yielding a span with a
null data pointer and a huge size.  The _File_sink constructor checks
only _M_write_buf().empty() (size == 0) before forcing buffer
initialization with __overflow, so the null span is accepted and the
format engine memcpys into nullptr -> SIGSEGV.

This is a regression from the P3107R5 implementation (8bd872f1ea7,
landed 2025-10-10): before that change the FILE* path formatted into a
_Str_sink and used fwrite, which handles this legal stream state; the
reproducer exits 0 on the pre-P3107R5 code and with this fix, and
SIGSEGVs on current master.  The change shipped in the released GCC
16.1.0 and 16.2.0; GCC 15.3 and earlier are unaffected.

Minimal reproducer: https://godbolt.org/z/eqvW3M8xd

Anlai Lu (1):
  libstdc++: Fix SIGSEGV in std::print with a setvbuf'd FILE

 libstdc++-v3/include/bits/print.h | 5 +++++
 1 file changed, 5 insertions(+)