diff options
| author | Corinna Vinschen <corinna@vinschen.de> | 2022-08-11 20:27:48 +0300 |
|---|---|---|
| committer | Corinna Vinschen <corinna@vinschen.de> | 2022-08-12 13:29:26 +0300 |
| commit | 85be74f2951968be7fe1979014d6246171ebd123 (patch) | |
| tree | 41de9537aa7ddb548f8ba9a982f93cca6a49cc9c /newlib/libc/locale | |
| parent | bf1d972d5c397125d879d6334c84012f166af9eb (diff) | |
newlocale: fix crash when trying to write to __C_locale
This simple testcase:
locale_t st = newlocale(LC_ALL_MASK, "C", (locale_t)0);
locale_t st2 = newlocale(LC_CTYPE_MASK, "en_US.UTF-8", st);
is sufficient to reproduce a crash in _newlocale_r. After the first call
to newlocale, `st' points to __C_locale, which is const. When using `st'
as locale base in the second call, _newlocale_r tries to set pointers
inside base to NULL. This is bad if base is __C_locale, obviously.
Add a test to avoid trying to overwrite pointer values inside base if
base is __C_locale.
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
Diffstat (limited to 'newlib/libc/locale')
| -rw-r--r-- | newlib/libc/locale/newlocale.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/newlib/libc/locale/newlocale.c b/newlib/libc/locale/newlocale.c index 0789d5fd9..08f29dbcc 100644 --- a/newlib/libc/locale/newlocale.c +++ b/newlib/libc/locale/newlocale.c @@ -188,7 +188,8 @@ _newlocale_r (struct _reent *p, int category_mask, const char *locale, if (tmp_locale.lc_cat[i].buf == (const void *) -1) { tmp_locale.lc_cat[i].buf = base->lc_cat[i].buf; - base->lc_cat[i].ptr = base->lc_cat[i].buf = NULL; + if (base != __get_C_locale ()) + base->lc_cat[i].ptr = base->lc_cat[i].buf = NULL; } #endif /* __HAVE_LOCALE_INFO__ */ _freelocale_r (p, base); |