[PATCH 0/1] libstdc++: Fix SIGSEGV in std::print with a setvbuf'd FILE

[Jonathan Wakely]

On Fri, 14 Aug 2026 at 13:50, Anlai Lu <agicy@qq.com> wrote:
>
> std::print(FILE*, ...) crashes with SIGSEGV when the FILE has a
> pre-allocated buffer (via setvbuf) that has never been written.
>
> Root cause: _File_sink::_File::_M_write_buf() returns
> {_IO_write_ptr, _IO_buf_end - _IO_write_ptr}.  After setvbuf glibc
> pre-allocates the buffer (so _IO_buf_end is valid) but keeps
> _IO_write_ptr as nullptr until the first write, yielding a span with a
> null data pointer and a huge size.  The _File_sink constructor checks
> only _M_write_buf().empty() (size == 0) before forcing buffer
> initialization with __overflow, so the null span is accepted and the
> format engine memcpys into nullptr -> SIGSEGV.
>
> This is a regression from the P3107R5 implementation (8bd872f1ea7,
> landed 2025-10-10): before that change the FILE* path formatted into a
> _Str_sink and used fwrite, which handles this legal stream state; the
> reproducer exits 0 on the pre-P3107R5 code and with this fix, and
> SIGSEGVs on current master.  The change shipped in the released GCC
> 16.1.0 and 16.2.0; GCC 15.3 and earlier are unaffected.

The information above should be included in the commit message.
Currently the commit message is quite brief, and missing the detail
above.

There is no need to send a separate [PATCH 0/1] cover letter for a
single patch, that's only needed for a patch series of two or more
related patches. For a single patch, all the relevant info should be
in the single commit message.

>
> Minimal reproducer: https://godbolt.org/z/eqvW3M8xd
>
> Anlai Lu (1):
>   libstdc++: Fix SIGSEGV in std::print with a setvbuf'd FILE
>
>  libstdc++-v3/include/bits/print.h | 5 +++++
>  1 file changed, 5 insertions(+)
>