stdio: Fix bugs in commit 3d94e07c49b5

The commit 3d94e07c49b5 has a few bugs which cause testsuite failure
in libstdc++. This is due to excess orientation check in __srefill_r()
and _ungetc_r(). Further, sscanf() family also calls ssvfscanf() family
with fp->_file == -1. This causes undesired orientation set/check for
sscanf() family. This patch fixes these problems.

Also, as in GLibC, do not set orientation in ungetc, and only set, but
do not check orientation in ungetwc.

Fixes: 3d94e07c49b5 ("newlib: libc: Fix crash on fprintf to a wide-oriented stream.")
Reported-by: Christophe Lyon <christophe.lyon@linaro.org>
Reported-by: Joel Sherrill <joel@rtems.org>
Co-developed-by: Corinna Vinschen <corinna@vinschen.de>
Signed-off-by: Takashi Yano <takashi.yano@nifty.ne.jp>
Signed-off-by: Corinna Vinschen <corinna@vinschen.de>

27 files changed, 43 insertions, 12 deletions

diff --git a/newlib/libc/stdio/asiprintf.c b/newlib/libc/stdio/asiprintf.c
index af25e9a57..dedb7fbfa 100644
--- a/newlib/libc/stdio/asiprintf.c
+++ b/newlib/libc/stdio/asiprintf.c
@@ -35,6 +35,7 @@ _asiprintf_r (struct _reent *ptr,
 
   /* mark a zero-length reallocatable buffer */
   f._flags = __SWR | __SSTR | __SMBF;
+  f._flags2 = 0;
   f._bf._base = f._p = NULL;
   f._bf._size = f._w = 0;
   f._file = -1;  /* No file. */
@@ -61,6 +62,7 @@ asiprintf (char **strp,
 
   /* mark a zero-length reallocatable buffer */
   f._flags = __SWR | __SSTR | __SMBF;
+  f._flags2 = 0;
   f._bf._base = f._p = NULL;
   f._bf._size = f._w = 0;
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/asniprintf.c b/newlib/libc/stdio/asniprintf.c
index 97e77748e..e930c8d69 100644
--- a/newlib/libc/stdio/asniprintf.c
+++ b/newlib/libc/stdio/asniprintf.c
@@ -36,6 +36,7 @@ _asniprintf_r (struct _reent *ptr,
       len = 0;
       buf = NULL;
     }
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) buf;
   /* For now, inherit the 32-bit signed limit of FILE._bf._size.
      FIXME - it would be nice to rewrite sys/reent.h to support size_t
@@ -82,6 +83,7 @@ asniprintf (char *buf,
       len = 0;
       buf = NULL;
     }
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) buf;
   /* For now, inherit the 32-bit signed limit of FILE._bf._size.
      FIXME - it would be nice to rewrite sys/reent.h to support size_t
diff --git a/newlib/libc/stdio/asnprintf.c b/newlib/libc/stdio/asnprintf.c
index f82556143..4c9ad5860 100644
--- a/newlib/libc/stdio/asnprintf.c
+++ b/newlib/libc/stdio/asnprintf.c
@@ -36,6 +36,7 @@ _asnprintf_r (struct _reent *__restrict ptr,
       len = 0;
       buf = NULL;
     }
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) buf;
   /* For now, inherit the 32-bit signed limit of FILE._bf._size.
      FIXME - it would be nice to rewrite sys/reent.h to support size_t
@@ -88,6 +89,7 @@ asnprintf (char *__restrict buf,
       len = 0;
       buf = NULL;
     }
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) buf;
   /* For now, inherit the 32-bit signed limit of FILE._bf._size.
      FIXME - it would be nice to rewrite sys/reent.h to support size_t
diff --git a/newlib/libc/stdio/asprintf.c b/newlib/libc/stdio/asprintf.c
index 542e70e4c..511d0e0f3 100644
--- a/newlib/libc/stdio/asprintf.c
+++ b/newlib/libc/stdio/asprintf.c
@@ -35,6 +35,7 @@ _asprintf_r (struct _reent *ptr,
 
   /* mark a zero-length reallocatable buffer */
   f._flags = __SWR | __SSTR | __SMBF;
+  f._flags2 = 0;
   f._bf._base = f._p = NULL;
   f._bf._size = f._w = 0;
   f._file = -1;  /* No file. */
@@ -67,6 +68,7 @@ asprintf (char **__restrict strp,
 
   /* mark a zero-length reallocatable buffer */
   f._flags = __SWR | __SSTR | __SMBF;
+  f._flags2 = 0;
   f._bf._base = f._p = NULL;
   f._bf._size = f._w = 0;
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/getc.c b/newlib/libc/stdio/getc.c
index c8781320e..12bffaf8f 100644
--- a/newlib/libc/stdio/getc.c
+++ b/newlib/libc/stdio/getc.c
@@ -81,6 +81,9 @@ _getc_r (struct _reent *ptr,
 {
   int result;
   CHECK_INIT (ptr, fp);
+  if (ORIENT (fp, -1) != -1)
+    return EOF;
+
   _newlib_flockfile_start (fp);
   result = __sgetc_r (ptr, fp);
   _newlib_flockfile_end (fp);
@@ -96,6 +99,9 @@ getc (register FILE *fp)
   struct _reent *reent = _REENT;
 
   CHECK_INIT (reent, fp);
+  if (ORIENT (fp, -1) != -1)
+    return EOF;
+
   _newlib_flockfile_start (fp);
   result = __sgetc_r (reent, fp);
   _newlib_flockfile_end (fp);
diff --git a/newlib/libc/stdio/refill.c b/newlib/libc/stdio/refill.c
index c1ef7e120..cd71ed152 100644
--- a/newlib/libc/stdio/refill.c
+++ b/newlib/libc/stdio/refill.c
@@ -43,9 +43,6 @@ __srefill_r (struct _reent * ptr,
 
   CHECK_INIT (ptr, fp);
 
-  if (ORIENT (fp, -1) != -1)
-    return EOF;
-
   fp->_r = 0;			/* largely a convenience for callers */
 
   /* SysV does not make this test; take it out for compatibility */
diff --git a/newlib/libc/stdio/siprintf.c b/newlib/libc/stdio/siprintf.c
index bd29edd88..b33792597 100644
--- a/newlib/libc/stdio/siprintf.c
+++ b/newlib/libc/stdio/siprintf.c
@@ -108,6 +108,7 @@ _siprintf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = INT_MAX;
   f._file = -1;  /* No file. */
@@ -129,6 +130,7 @@ siprintf (char *str,
   FILE f;
 
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = INT_MAX;
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/siscanf.c b/newlib/libc/stdio/siscanf.c
index b88b81088..4c1363d0a 100644
--- a/newlib/libc/stdio/siscanf.c
+++ b/newlib/libc/stdio/siscanf.c
@@ -90,6 +90,7 @@ siscanf (const char *str,
   FILE f;
 
   f._flags = __SRD | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._r = strlen (str);
   f._read = __seofread;
@@ -114,6 +115,7 @@ _siscanf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SRD | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._r = strlen (str);
   f._read = __seofread;
diff --git a/newlib/libc/stdio/sniprintf.c b/newlib/libc/stdio/sniprintf.c
index b05ffcb12..852713f1f 100644
--- a/newlib/libc/stdio/sniprintf.c
+++ b/newlib/libc/stdio/sniprintf.c
@@ -42,6 +42,7 @@ _sniprintf_r (struct _reent *ptr,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
@@ -73,6 +74,7 @@ sniprintf (char *str,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/snprintf.c b/newlib/libc/stdio/snprintf.c
index 4a3084bea..b6130b998 100644
--- a/newlib/libc/stdio/snprintf.c
+++ b/newlib/libc/stdio/snprintf.c
@@ -41,6 +41,7 @@ _snprintf_r (struct _reent *ptr,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
@@ -78,6 +79,7 @@ snprintf (char *__restrict str,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/sprintf.c b/newlib/libc/stdio/sprintf.c
index be66ec6f5..92cae4618 100644
--- a/newlib/libc/stdio/sprintf.c
+++ b/newlib/libc/stdio/sprintf.c
@@ -584,6 +584,7 @@ _sprintf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = INT_MAX;
   f._file = -1;  /* No file. */
@@ -611,6 +612,7 @@ sprintf (char *__restrict str,
   FILE f;
 
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = INT_MAX;
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/sscanf.c b/newlib/libc/stdio/sscanf.c
index 9c50361bc..52145fc46 100644
--- a/newlib/libc/stdio/sscanf.c
+++ b/newlib/libc/stdio/sscanf.c
@@ -429,6 +429,7 @@ sscanf (const char *__restrict str,
   FILE f;
 
   f._flags = __SRD | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._r = strlen (str);
   f._read = __seofread;
@@ -459,6 +460,7 @@ _sscanf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SRD | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._r = strlen (str);
   f._read = __seofread;
diff --git a/newlib/libc/stdio/swprintf.c b/newlib/libc/stdio/swprintf.c
index 634b22beb..e590b522c 100644
--- a/newlib/libc/stdio/swprintf.c
+++ b/newlib/libc/stdio/swprintf.c
@@ -568,6 +568,7 @@ _swprintf_r (struct _reent *ptr,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? (size - 1) * sizeof (wchar_t) : 0);
   f._file = -1;  /* No file. */
@@ -608,6 +609,7 @@ swprintf (wchar_t *__restrict str,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? (size - 1) * sizeof (wchar_t) : 0);
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/swscanf.c b/newlib/libc/stdio/swscanf.c
index 578ac3c93..0ef4d0ebd 100644
--- a/newlib/libc/stdio/swscanf.c
+++ b/newlib/libc/stdio/swscanf.c
@@ -422,6 +422,7 @@ swscanf (const wchar_t *__restrict str, const wchar_t *__restrict fmt, ...)
   FILE f;
 
   f._flags = __SRD | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._r = wcslen (str) * sizeof (wchar_t);
   f._read = __seofread;
@@ -446,6 +447,7 @@ _swscanf_r (struct _reent *ptr, const wchar_t *str, const wchar_t *fmt, ...)
   FILE f;
 
   f._flags = __SRD | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._r = wcslen (str) * sizeof (wchar_t);
   f._read = __seofread;
diff --git a/newlib/libc/stdio/ungetc.c b/newlib/libc/stdio/ungetc.c
index 79914af08..8b10c8218 100644
--- a/newlib/libc/stdio/ungetc.c
+++ b/newlib/libc/stdio/ungetc.c
@@ -125,12 +125,6 @@ _ungetc_r (struct _reent *rptr,
 
   _newlib_flockfile_start (fp);
 
-  if (ORIENT (fp, -1) != -1)
-    {
-      _newlib_flockfile_exit (fp);
-      return EOF;
-    }
-
   /* After ungetc, we won't be at eof anymore */
   fp->_flags &= ~__SEOF;
 
diff --git a/newlib/libc/stdio/ungetwc.c b/newlib/libc/stdio/ungetwc.c
index 18636d773..16d37f2d1 100644
--- a/newlib/libc/stdio/ungetwc.c
+++ b/newlib/libc/stdio/ungetwc.c
@@ -82,9 +82,8 @@ _ungetwc_r (struct _reent *ptr,
   size_t len;
 
   _newlib_flockfile_start (fp);
-  if (ORIENT (fp, 1) != 1)
-    wc = WEOF;
-  else if (wc == WEOF)
+  ORIENT (fp, 1);
+  if (wc == WEOF)
     wc = WEOF;
   else if ((len = _wcrtomb_r(ptr, buf, wc, &fp->_mbstate)) == (size_t)-1)
     {
diff --git a/newlib/libc/stdio/vasiprintf.c b/newlib/libc/stdio/vasiprintf.c
index 1deb2dbcf..d9c11eaf5 100644
--- a/newlib/libc/stdio/vasiprintf.c
+++ b/newlib/libc/stdio/vasiprintf.c
@@ -50,6 +50,7 @@ _vasiprintf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SWR | __SSTR | __SMBF ;
+  f._flags2 = 0;
   f._bf._base = f._p = NULL;
   f._bf._size = f._w = 0;
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/vasniprintf.c b/newlib/libc/stdio/vasniprintf.c
index b24cd96fb..c85ca06e8 100644
--- a/newlib/libc/stdio/vasniprintf.c
+++ b/newlib/libc/stdio/vasniprintf.c
@@ -36,6 +36,7 @@ _vasniprintf_r (struct _reent *ptr,
       len = 0;
       buf = NULL;
     }
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) buf;
   /* For now, inherit the 32-bit signed limit of FILE._bf._size.
      FIXME - it would be nice to rewrite sys/reent.h to support size_t
diff --git a/newlib/libc/stdio/vasnprintf.c b/newlib/libc/stdio/vasnprintf.c
index b3787ec7a..02f55caa9 100644
--- a/newlib/libc/stdio/vasnprintf.c
+++ b/newlib/libc/stdio/vasnprintf.c
@@ -36,6 +36,7 @@ _vasnprintf_r (struct _reent *ptr,
       len = 0;
       buf = NULL;
     }
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) buf;
   /* For now, inherit the 32-bit signed limit of FILE._bf._size.
      FIXME - it would be nice to rewrite sys/reent.h to support size_t
diff --git a/newlib/libc/stdio/vasprintf.c b/newlib/libc/stdio/vasprintf.c
index d7ec9c840..b466936bd 100644
--- a/newlib/libc/stdio/vasprintf.c
+++ b/newlib/libc/stdio/vasprintf.c
@@ -56,6 +56,7 @@ _vasprintf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SWR | __SSTR | __SMBF ;
+  f._flags2 = 0;
   f._bf._base = f._p = NULL;
   f._bf._size = f._w = 0;
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/vsiprintf.c b/newlib/libc/stdio/vsiprintf.c
index 8128cb772..af07ad85e 100644
--- a/newlib/libc/stdio/vsiprintf.c
+++ b/newlib/libc/stdio/vsiprintf.c
@@ -50,6 +50,7 @@ _vsiprintf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = INT_MAX;
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/vsiscanf.c b/newlib/libc/stdio/vsiscanf.c
index d7135ef71..4e28d1079 100644
--- a/newlib/libc/stdio/vsiscanf.c
+++ b/newlib/libc/stdio/vsiscanf.c
@@ -49,6 +49,7 @@ _vsiscanf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SRD | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._r = strlen (str);
   f._read = __seofread;
diff --git a/newlib/libc/stdio/vsniprintf.c b/newlib/libc/stdio/vsniprintf.c
index e7625ffd5..a50a0a993 100644
--- a/newlib/libc/stdio/vsniprintf.c
+++ b/newlib/libc/stdio/vsniprintf.c
@@ -58,6 +58,7 @@ _vsniprintf_r (struct _reent *ptr,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/vsnprintf.c b/newlib/libc/stdio/vsnprintf.c
index ecf82eaef..d9c72b526 100644
--- a/newlib/libc/stdio/vsnprintf.c
+++ b/newlib/libc/stdio/vsnprintf.c
@@ -64,6 +64,7 @@ _vsnprintf_r (struct _reent *ptr,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/vsprintf.c b/newlib/libc/stdio/vsprintf.c
index 4d51fd0dc..4d4619fd0 100644
--- a/newlib/libc/stdio/vsprintf.c
+++ b/newlib/libc/stdio/vsprintf.c
@@ -56,6 +56,7 @@ _vsprintf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = INT_MAX;
   f._file = -1;  /* No file. */
diff --git a/newlib/libc/stdio/vsscanf.c b/newlib/libc/stdio/vsscanf.c
index e9e84088f..6150f541b 100644
--- a/newlib/libc/stdio/vsscanf.c
+++ b/newlib/libc/stdio/vsscanf.c
@@ -55,6 +55,7 @@ _vsscanf_r (struct _reent *ptr,
   FILE f;
 
   f._flags = __SRD | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._r = strlen (str);
   f._read = __seofread;
diff --git a/newlib/libc/stdio/vswprintf.c b/newlib/libc/stdio/vswprintf.c
index 08a8545ba..ab2e52ff4 100644
--- a/newlib/libc/stdio/vswprintf.c
+++ b/newlib/libc/stdio/vswprintf.c
@@ -46,6 +46,7 @@ _vswprintf_r (struct _reent *ptr,
       return EOF;
     }
   f._flags = __SWR | __SSTR;
+  f._flags2 = 0;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? (size - 1) * sizeof (wchar_t) : 0);
   f._file = -1;  /* No file. */