Date: Wed, 21 Apr 2004 08:20:22 -0000 From: "Steven Smith" <sos22@cam.ac.uk> To: FreeBSD-gnats-submit@FreeBSD.org Subject: misc/65841: [patch] vfprintf on CURRENT produces odd results when used with many arguments Message-ID: <E1BGCvO-0003ku-00@yellow.csi.cam.ac.uk> Resent-Message-ID: <200404210820.i3L8KLxu024597@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 65841
>Category: misc
>Synopsis: [patch] vfprintf on CURRENT produces odd results when used with many arguments
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Apr 21 01:20:21 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator: Steven Smith
>Release: FreeBSD 5.2-CURRENT i386
>Organization:
>Environment:
System: FreeBSD archibold.chu.cam.ac.uk 5.2-CURRENT FreeBSD 5.2-CURRENT #14: Mon Apr 19 17:59:53 BST 2004 sos22@archibold.chu.cam.ac.uk:/usr/src/sys/i386/compile/ARCHYKERNEL i386
>Description:
__grow_type_table in src/lib/libc/stdio/vfprintf.c treats tablesize
as a byte count, whereas the rest of the code treats it as a
count of the elements in an array. This causes problems if a
large number of arguments are used in a printf format and some
``%5$d''-style escapes are used to refer to arguments by index.
>How-To-Repeat:
The attached program test.c produces output
``1 -791621424 -791621424 -791621424 -791621424 -791621424 -791621424 2''
>Fix:
The attached patch printf.diff seems to fix the problem. Patch is
against CVS version 1.63.
--- test.c begins here ---
#include <stdio.h>
int
main()
{
printf("%1$d %2$d %3$d %4$d %5$d %6$d %7$d %8$d\n",
1,2,3,4,5,6,7,8);
return 0;
}
--- test.c ends here ---
--- printf.diff begins here ---
Index: lib/libc/stdio/vfprintf.c
===================================================================
RCS file: /home/ncvs/src/lib/libc/stdio/vfprintf.c,v
retrieving revision 1.63
diff -u -w -r1.63 vfprintf.c
--- lib/libc/stdio/vfprintf.c 7 Apr 2004 09:55:05 -0000 1.63
+++ lib/libc/stdio/vfprintf.c 21 Apr 2004 07:47:41 -0000
@@ -1595,14 +1595,15 @@
if (newsize < nextarg + 1)
newsize = nextarg + 1;
if (oldsize == STATIC_ARG_TBL_SIZE) {
- if ((newtable = malloc(newsize)) == NULL)
+ if ((newtable = malloc(newsize * sizeof(enum typeid))) == NULL)
abort(); /* XXX handle better */
- bcopy(oldtable, newtable, oldsize);
+ bcopy(oldtable, newtable, oldsize * sizeof(enum typeid));
} else {
- if ((newtable = reallocf(oldtable, newsize)) == NULL)
+ newtable = reallocf(oldtable, newsize * sizeof(enum typeid));
+ if (newtable == NULL)
abort(); /* XXX handle better */
}
- memset(&newtable[oldsize], T_UNUSED, newsize - oldsize);
+ memset(&newtable[oldsize], T_UNUSED, (newsize - oldsize) * sizeof(enum typeid));
*typetable = newtable;
*tablesize = newsize;
--- printf.diff ends here ---
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E1BGCvO-0003ku-00>