diff options
author | Silviu Baranga <silviu.baranga@arm.cm> | 2017-06-05 11:54:42 +0300 |
---|---|---|
committer | Corinna Vinschen <corinna@vinschen.de> | 2017-06-09 16:30:47 +0300 |
commit | efaef1bba263501e1e7264833ddfc9b8c20f9ebc (patch) | |
tree | aa7a5845d4d817b38254880e6bdd0e60886f2787 /newlib/libc/stdio | |
parent | 556200022524a7baf9d1f85b50322a40306f004d (diff) |
Don't overread or write memory returned by _DTOA_R
Don't over-read memory returned by _DTOA_R, and never write to it
since the result might be a string literal.
For example, when doing:
swprintf(tt, 20, L"%.*f", 6, 0.0);
we will get back "0".
Instead, write the result returned by _DTOA_R to the output buffer.
After this, write the 0 chars directly to the the output buffer
(if there are any). This also has the (marginal) advantage that
we read/write less memory overall.
Diffstat (limited to 'newlib/libc/stdio')
-rw-r--r-- | newlib/libc/stdio/vfwprintf.c | 25 |
1 files changed, 13 insertions, 12 deletions
diff --git a/newlib/libc/stdio/vfwprintf.c b/newlib/libc/stdio/vfwprintf.c index 4786ed6a9..f0872fd55 100644 --- a/newlib/libc/stdio/vfwprintf.c +++ b/newlib/libc/stdio/vfwprintf.c @@ -1631,12 +1631,18 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags, { char *digits, *bp, *rve; -#ifndef _MB_CAPABLE int i; -#endif digits = _DTOA_R (data, value, mode, ndigits, decpt, &dsgn, &rve); +#ifdef _MB_CAPABLE + _mbsnrtowcs_r (data, buf, (const char **) &digits, rve - digits, + len, NULL); +#else + for (i = 0; i < rve - digits && i < len; ++i) + buf[i] = (wchar_t) digits[i]; +#endif + if ((ch != L'g' && ch != L'G') || flags & ALT) { /* Print trailing zeros */ bp = digits + ndigits; if (ch == L'f' || ch == L'F') { @@ -1646,18 +1652,13 @@ wcvt(struct _reent *data, _PRINTF_FLOAT_TYPE value, int ndigits, int flags, } if (value == 0) /* kludge for __dtoa irregularity */ rve = bp; - while (rve < bp) - *rve++ = '0'; - } + for (i = rve - digits; i < bp - digits && i < len; ++i) + buf[i] = L'0'; + + rve = rve > bp ? rve : bp; + } *length = rve - digits; /* full length of the string */ -#ifdef _MB_CAPABLE - _mbsnrtowcs_r (data, buf, (const char **) &digits, *length, - len, NULL); -#else - for (i = 0; i < *length && i < len; ++i) - buf[i] = (wchar_t) digits[i]; -#endif return buf; } } |