glibc/trunk/cve-2023-25139.patch

   1 This is a partial fix for mishandling of grouping when formatting
   2 integers.  It properly computes the width in presence of grouping
   3 characteres when the precision is larger than the number of significant
   4 digits.
   5 ---
   6  stdio-common/Makefile               |  1 +
   7  stdio-common/tst-grouping3.c        | 37 +++++++++++++++++++++++++++++
   8  stdio-common/vfprintf-process-arg.c |  2 +-
   9  3 files changed, 39 insertions(+), 1 deletion(-)
  10  create mode 100644 stdio-common/tst-grouping3.c
  11
  12 diff --git a/stdio-common/Makefile b/stdio-common/Makefile
  13 index 6e9d104524..b46d932a20 100644
  14 --- a/stdio-common/Makefile
  15 +++ b/stdio-common/Makefile
  16 @@ -195,6 +195,7 @@ tests := \
  17    tst-gets \
  18    tst-grouping \
  19    tst-grouping2 \
  20 +  tst-grouping3 \
  21    tst-long-dbl-fphex \
  22    tst-memstream-string \
  23    tst-obprintf \
  24 diff --git a/stdio-common/tst-grouping3.c b/stdio-common/tst-grouping3.c
  25 new file mode 100644
  26 index 0000000000..0031ad4010
  27 --- /dev/null
  28 +++ b/stdio-common/tst-grouping3.c
  29 @@ -0,0 +1,37 @@
  30 +/* Test printf with grouping and padding (bug 23432)
  31 +   Copyright (C) 2023 Free Software Foundation, Inc.
  32 +   This file is part of the GNU C Library.
  33 +
  34 +   The GNU C Library is free software; you can redistribute it and/or
  35 +   modify it under the terms of the GNU Lesser General Public
  36 +   License as published by the Free Software Foundation; either
  37 +   version 2.1 of the License, or (at your option) any later version.
  38 +
  39 +   The GNU C Library is distributed in the hope that it will be useful,
  40 +   but WITHOUT ANY WARRANTY; without even the implied warranty of
  41 +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  42 +   Lesser General Public License for more details.
  43 +
  44 +   You should have received a copy of the GNU Lesser General Public
  45 +   License along with the GNU C Library; if not, see
  46 +   <https://www.gnu.org/licenses/>.  */
  47 +
  48 +#include <locale.h>
  49 +#include <stdio.h>
  50 +#include <support/check.h>
  51 +#include <support/support.h>
  52 +
  53 +static int
  54 +do_test (void)
  55 +{
  56 +  char buf[80];
  57 +
  58 +  xsetlocale (LC_NUMERIC, "de_DE.UTF-8");
  59 +
  60 +  sprintf (buf, "%+-'13.9d", 1234567);
  61 +  TEST_COMPARE_STRING (buf, "+001.234.567 ");
  62 +
  63 +  return 0;
  64 +}
  65 +
  66 +#include <support/test-driver.c>
  67 diff --git a/stdio-common/vfprintf-process-arg.c b/stdio-common/vfprintf-process-arg.c
  68 index 2c651946df..cd3eaf5c0c 100644
  69 --- a/stdio-common/vfprintf-process-arg.c
  70 +++ b/stdio-common/vfprintf-process-arg.c
  71 @@ -257,7 +257,7 @@ LABEL (unsigned_number):      /* Unsigned number of base BASE.  */
  72            width -= 2;
  73          }
  74
  75 -      width -= workend - string + prec;
  76 +      width -= number_length + prec;
  77
  78        Xprintf_buffer_pad (buf, L_('0'), prec);
  79
  80 --
  81 2.39.1