fix crash/out-of-bound read in sscanf

commit d6c855caa88ddb1ab6e24e23a14b1e7baf4ba9c7 caused this
"regression", though the behavior was undefined before, overlooking
that f->shend=0 was being used as a sentinel for "EOF" status (actual
EOF or hitting the scanf field width) of the stream helper (shgetc)
functions.

obviously the shgetc macro could be adjusted to check for a null
pointer in addition to the != comparison, but it's the hot path, and
adding extra code/branches to it begins to defeat the purpose.

so instead of setting shend to a null pointer to block further reads,
which no longer works, set it to the current position (rpos). this
makes the shgetc macro work with no change, but it breaks shunget,
which can no longer look at the value of shend to determine whether to
back up. Szabolcs Nagy suggested a solution which I'm using here:
setting shlim to a negative value is inexpensive to test at shunget
time, and automatically re-trips the cnt>=shlim stop condition in
__shgetc no matter what the original limit was.

diff --git a/src/internal/shgetc.c b/src/internal/shgetc.c
index ebd5fae707b4ad44abfaf21cff797d9bcd37e26e..a4a9c633dc976033622003c3cc7e5068466076bd 100644 (file)
--- a/src/internal/shgetc.c
+++ b/src/internal/shgetc.c
@@ -22,7 +22,8 @@ int __shgetc(FILE *f)
        off_t cnt = shcnt(f);
        if (f->shlim && cnt >= f->shlim || (c=__uflow(f)) < 0) {
                f->shcnt = f->buf - f->rpos + cnt;
-               f->shend = 0;
+               f->shend = f->rpos;
+               f->shlim = -1;
                return EOF;
        }
        cnt++;

diff --git a/src/internal/shgetc.h b/src/internal/shgetc.h
index 1c30f75f4bad2564391c2e0fb1bff2b0b34b8883..9435381a61d1ee45c373c87bf7bcb5b43b370676 100644 (file)
--- a/src/internal/shgetc.h
+++ b/src/internal/shgetc.h
@@ -26,7 +26,7 @@ hidden int __shgetc(FILE *);
 #define shcnt(f) ((f)->shcnt + ((f)->rpos - (f)->buf))
 #define shlim(f, lim) __shlim((f), (lim))
 #define shgetc(f) (((f)->rpos != (f)->shend) ? *(f)->rpos++ : __shgetc(f))
-#define shunget(f) ((f)->shend ? (void)(f)->rpos-- : (void)0)
+#define shunget(f) ((f)->shlim>=0 ? (void)(f)->rpos-- : (void)0)
 
 #define sh_fromstring(f, s) \
        ((f)->buf = (f)->rpos = (void *)(s), (f)->rend = (void*)-1)