Commit Graph

625 Commits

Author SHA1 Message Date
Joel Dahl
1848dd2aec mdoc: Remove EOL whitespace. 2013-02-09 07:01:05 +00:00
Pietro Cerutti
71796d333c - Fix more style(9)-related issues (copyright header, spaces after function
names, unnecessary casts)
- Change type of boolean variable from char to bool

Suggested by:	jhb, zont, jmallett
Reviewed by:	cognet
Approved by:	cognet
2013-02-01 13:04:06 +00:00
Pietro Cerutti
646b68f04d - Remove underscores from the internal structure name, as it doesn't collide
with the user's namespace.

- Correct size and position variables type from long to size_t.

- Do not set errno to ENOMEM on malloc failure, as malloc already does so.

- Implement the concept of "buffer data length", which mandates what SEEK_END
  refers to and the allowed extent for a read.

- Use NULL as read-callback if the buffer is opened in write-only mode.
  Conversely, use NULL as write-callback when opened in read-only mode.

- Implement the handling of the ``b'' character in the mode argument. A binary
  buffer differs from a text buffer (default mode if ``b'' is omitted) in that
  NULL bytes are never appended to writes and that the "buffer data length"
  equals to the size of the buffer.

- Remove shall from the man page. Use indicative instead. Also, specify that
  the ``b'' flag does not conform with POSIX but is supported by glibc.

- Update the regression test so that the ``b'' functionality and the "buffer
  data length" concepts are tested.

- Minor style(9) corrections.

Suggested by:	jilles
Reviewed by:	cognet
Approved by:	cognet
2013-01-31 16:39:50 +00:00
Pietro Cerutti
96c95412ca Add fmemopen(3), an interface to get a FILE * from a buffer in memory, along
with the respective regression test.
See http://pubs.opengroup.org/onlinepubs/9699919799/functions/fmemopen.html

Reviewed by:	cognet
Approved by:	cognet
2013-01-30 14:59:26 +00:00
Eitan Adler
8c039ae154 The getline function returns the number of characters read, not
written. Use clearer text for this.

PR:		docs/174023
Submitted by:	Paul Procacci <pprocacci@gmail.com>
Approved by:	bcr (mentor)
MFC after:	1 week
2012-12-01 15:25:41 +00:00
Jilles Tjoelker
5ba651f004 libc: Allow setting close-on-exec in fopen/freopen/fdopen.
This commit adds a new mode option 'e' that must follow any 'b', '+' and/or
'x' options. C11 is clear about the 'x' needing to follow 'b' and/or '+' and
that is what we implement; therefore, require a strict position for 'e' as
well.

For freopen() with a non-NULL path argument and fopen(), the close-on-exec
flag is set iff the 'e' mode option is specified. For freopen() with a NULL
path argument and fdopen(), the close-on-exec flag is turned on if the 'e'
mode option is specified and remains unchanged otherwise.

Although the same behaviour for fopen() can be obtained by open(O_CLOEXEC)
and fdopen(), this needlessly complicates the calling code.

Apart from the ordering requirement, the new option matches glibc.

PR:		kern/169320
2012-11-30 23:51:33 +00:00
Greg Lehey
a012e04865 Clarify that the ' flag is an apostrophe.
MFC after:	2 weeks
2012-11-08 02:01:04 +00:00
Jilles Tjoelker
cc32b2eda8 fopen(3): Mention that the "x" mode option is from C11.
MFC after:	1 week
2012-11-01 22:47:42 +00:00
Eitan Adler
96240c89f0 Correct double "the the"
Approved by:	cperciva
MFC after:	3 days
2012-09-14 21:28:56 +00:00
Pawel Jakub Dawidek
988a521bf0 The register_printf_render_std() function expects regular string.
Change argument type from 'const unsigned char *' to 'const char *'.

MFC after:	2 weeks
2012-07-04 17:35:07 +00:00
Eitan Adler
e5d9109aab Only set _w to 0 when the file stream is not currently reading. Without
this fflush may fail to write data in the buffer.

PR:		kern/137819
Submitted by:	Eric Blake <ebb9@byu.net>
Reviewed by:	theraven
Approved by:	cperciva
MFC after:	2 weeks
2012-05-30 04:06:38 +00:00
Isabell Long
af27459ace Add two new locale-specific man pages:
- libc/stdio/scanf_l.3
- libc/stdio/printf_l.3

Reviewed by:	theraven
Approved by:	gabor (mentor)
MFC after:	5 days
2012-05-23 17:13:30 +00:00
Joel Dahl
790752beb4 Minor mdoc nits. 2012-05-12 20:27:13 +00:00
Eitan Adler
9ff418da7f Remove reference to non-existent FreeBSD Security Architecture
Approved by:	cperciva
MFC after:	3 days
2012-05-09 17:27:49 +00:00
Jean-Sébastien Pédron
671c033623 Remove incorrect __restrict qualifier on several pointers
The typical case was:
static __inline int
convert_ccl(FILE *fp, char * __restrict p, [...])
{
        [...]

        if (p == SUPPRESS_PTR) {
		[...]
	} else {
		[...]
	}

	[...]
}

This qualifier says that the pointer is the only one at that time
pointing to the resource.

Here, clang considers that "p" will never match "SUPPRESS_PTR" and
optimize the if{} block out. This leads to segfaults in programs calling
vfscanf(3) and vfwscanf(3) with just the format string (no arguments
following it).

The following softwares were reported to abort with segmentation fault
and this patch fixes it:
    o  cmake
    o  smartd
    o  devel/ORBit2

dim@ opened an LLVM PR to discuss this clang optimization:
    http://llvm.org/bugs/show_bug.cgi?id=12656

Tested by:	bsam@
2012-04-30 11:28:17 +00:00
David Schultz
cbd3cbbae0 Fix a bug in *wscanf's handling of non-wide %s, %c, and %[
conversions.  Both the specification and the documentation say the
width is interpreted as the max number of wide characters to read, but
the implementation was interpreting it as the number of bytes to convert.
(See also r105317.)

This change has security implications for any applications that depend
on the buggy behavior, but the impact in practice is probably nil.
Any such application would already be buggy on other platforms that
get the semantics right.  Also, these conversions are rarely used;
%ls, %lc, and %l[ are more appropriate.
2012-04-30 01:08:18 +00:00
David Schultz
d7af8cf14b Previously, vfscanf()'s wide character processing functions were
reading wide characters manually.  With this change, they now use
fgetwc().  To make this work, we use an internal version of fgetwc()
with a few extensions: it takes an mbstate * because non-wide streams
don't have a built-in mbstate, and it indicates the number of bytes
read.

vfscanf() now resembles vfwscanf() more closely.  Minor functional
improvements include working xlocale support in vfscanf(), setting the
stream error indicator on encoding errors, and proper handling of
shift-based encodings.  (Actually, making shift-based encodings work
with non-wide streams is hopeless, but the implementation now matches
the broken specification.)
2012-04-29 16:28:39 +00:00
Jeremie Le Hen
5a239e7000 Fix small documentation mistakes.
Submitted by:	brueffer
Approved by:	kib (mentor)
2012-04-28 21:50:30 +00:00
Jeremie Le Hen
6486b015fc Import stdbuf(1) and the shared library it relies on.
This tool changes the default buffering behaviour of standard
stdio streams.

It only works on dynamic binaries.  To make it work for static
ones it would require cluttering stdio because there no single
entry point.

PR:		166660
Reviewed by:	current@, jhb
Approved by:	kib (mentor)
MFC after:	1 week
2012-04-28 20:52:20 +00:00
Konstantin Belousov
46ffdf3bbd Take the spinlock around clearing of the fp->_flags in fclose(3), which
indicates the avaliability of FILE, to prevent possible reordering of
the writes as seen by other CPUs.

Reported by:	Fengwei yin <yfw.bsd gmail com>
Reviewed by:	jhb
MFC after:	1 week
2012-04-24 17:51:36 +00:00
David Schultz
06b4e48852 Bugfix: Include whitespace characters in the count of the number of
characters read.
2012-04-22 21:28:33 +00:00
David Schultz
f010dc7dc4 Bugfix: Correctly count the number of characters read for %l[ conversions. 2012-04-22 21:28:14 +00:00
David Schultz
01d2a7858e Bugfix: %n doesn't count as a conversion, so
sscanf("abc", "ab%ncd", &i) returns EOF, not 0.
2012-04-22 21:22:14 +00:00
David Schultz
51300896cb Refactor scanf to improve modularity. Conversions are now performed
by separate conversion functions.  This will hopefully make bugs more
noticeable (I noticed several already) and provide opportunities to
reduce code duplication.
2012-04-22 21:18:41 +00:00
David Schultz
86dc3a9ae2 As noted by Peter Jeremy, r234528 only partially fixed the infinite
loop bug introduced in r187302.  This completes the fix.

PR:		167039
MFC after:	3 days
2012-04-21 07:31:27 +00:00
David Schultz
666d00d34a If the size passed to {,v}s{w,n}printf is larger than INT_MAX+1
(i.e., the return value would overflow), set errno to EOVERFLOW
and return an error.  This improves the chances that buggy
applications -- for instance, ones that pass in a negative integer
as the size due to a bogus calculation -- will fail in safe ways.
Returning an error in these situations is specified by POSIX, but
POSIX appears to have an off-by-one error that isn't duplicated in
this change.

Previously, some of these functions would silently cap the size at
INT_MAX+1, and others would exit with an error after writing more
than INT_MAX characters.

PR:		39256
MFC after:	2 weeks
2012-04-21 06:10:18 +00:00
David Schultz
31fe39edac - Fix the claim that the output is always null-terminated. This isn't
true if the size is zero.
- Fix a claim that sprintf() is the same as snprintf() with an
  infinite size.  It's equivalent to snprintf() with a size of
  INT_MAX + 1.
- Document the return values in the return values section.
- Document the possible errno value of EOVERFLOW.

MFC after:	2 weeks
2012-04-21 06:09:09 +00:00
David Schultz
04acf36509 Ensure that the {,v}swprintf functions always null-terminate the
output string, even if an encoding error or malloc failure occurs.
2012-04-21 06:08:29 +00:00
David Schultz
177628ce75 Fix a bug introduced in r187302 that was causing fputws() to enter an
infinite loop pretty much unconditionally.  It's remarkable that the
patch that introduced the bug was never tested, but even more
remarkable that nobody noticed for over two years.

PR:		167039
MFC after:	3 days
2012-04-21 06:08:02 +00:00
Eitan Adler
50d675f7a9 Remove trailing whitespace per mdoc lint warning
Disussed with:	gavin
No objection from:	doc
Approved by:	joel
MFC after:	3 days
2012-03-29 05:02:12 +00:00
Eitan Adler
a8448a8ce7 Remove outdated comment of seven years
PR:		docs/116116
Approved by:	cperciva
MFC after:	1 week
2012-03-04 16:44:04 +00:00
Eitan Adler
008474bbf1 Remove reference to gcc's non-standard -fwritable-strings, which
doesn't exist in recent releases (and is bad advice anyway)

PR:		docs/163119
Submitted by:	Yuri Pankov <yuri.pankov@gmail.com>
Approved by:	cperciva
MFC after:	1 week
2012-03-04 16:41:07 +00:00
David Chisnall
3c87aa1d3d Implement xlocale APIs from Darwin, mainly for use by libc++. This adds a
load of _l suffixed versions of various standard library functions that use
the global locale, making them take an explicit locale parameter.  Also
adds support for per-thread locales.  This work was funded by the FreeBSD
Foundation.

Please test any code you have that uses the C standard locale functions!

Reviewed by:    das (gdtoa changes)
Approved by:    dim (mentor)
2011-11-20 14:45:42 +00:00
David Schultz
bd26fb812d Add support for the 'x' mode option in fopen() as specified in the C1X
draft standard.  The option is equivalent to O_EXCL.

MFC after:	1 month
2011-10-21 06:35:58 +00:00
Pawel Jakub Dawidek
a9cf49ab39 Because we call __printf_out() with a on-stack buffer, also call
__printf_flush() so we are sure it won't be referenced after we return.

MFC after:	2 weeks
2011-03-06 19:47:46 +00:00
Pawel Jakub Dawidek
f03ca7241b Fix various issues in how %#T is handled:
- If precision is 0, don't print period followed by no digits.
- If precision is 0 stop printing units as soon as possible
  (eg. if we have three years and five days and precision is 0
   print only 3y5d).
- If precision is not 0, print all units (eg. 3y0d0h0m0s.00).

MFC after:	2 weeks
2011-03-06 17:43:32 +00:00
John Baldwin
cc3d85727d When reopening a stream backed by an open file descriptor, do not close
the existing file descriptor.  Instead, let dup2() atomically close the
old file descriptor when assigning the newly opened file to the same
descriptor.  This closes a race in a multithreaded application where a
concurrent open() could allocate the existing file descriptor in between
the calls to close() and dup2().

PR:		threads/79887
Submitted by:	Dmitrij Tejblum  tejblum of yandex-team.ru
Reviewed by:	davidxu
MFC after:	1 week
2010-12-09 20:28:30 +00:00
Gavin Atkinson
da1e775d12 Remove two unused variables, left over from the refactoring in r180104.
PR:		bin/152551
Submitted by:	Henning Petersen <henning.petersen t-online.de>
MFC after:	2 weeks
2010-12-02 13:40:21 +00:00
David Schultz
06127c9c2a Update the documentation to reflect changes to the implementation in
r197752, which is related to handling of null buffer pointers.  Also
make a few minor wording changes.

Reported by:	jh@
2010-11-30 21:26:21 +00:00
Rebecca Cran
5512804bb8 Revert changes of 'assure' to 'ensure' made in r211936.
Approved by: rrs (mentor)
2010-09-11 10:49:56 +00:00
Rebecca Cran
e7f8dd75b3 Fix incorrect usage of 'assure' and 'insure'.
Approved by: rrs (mentor)
2010-08-28 16:32:01 +00:00
Ulrich Spörlein
0afc94c17a mdoc: move CAVEATS, BUGS and SECURITY CONSIDERATIONS sections to the
bottom of the manpages and order them consistently.

GNU groff doesn't care about the ordering, and doesn't even mention
CAVEATS and SECURITY CONSIDERATIONS as common sections and where to put
them.

Found by:	mdocml lint run
Reviewed by:	ru
2010-05-13 12:07:55 +00:00
Ulrich Spörlein
2a10d6d199 mdoc: fix parenthesis
Reviewed by:	brueffer
2010-05-11 23:08:31 +00:00
Ulrich Spörlein
488704b28a mdoc: use macro for +- that is understood by mdocml
Reviewed by:	brueffer
2010-05-11 23:08:15 +00:00
David E. O'Brien
6a18a77221 I feel this wording of the history is more clear.
ANSIfy vasprintf() while I'm here.
2010-04-05 22:09:29 +00:00
John Baldwin
1b0181df2f - Use an initializer macro to initialize fields in 'fake' FILE objects used
by *sprintf(), etc.
- Explicitly initialize _fl_mutex to PTHREAD_MUTEX_INITIALIZER for all FILE
  objects.  This is currently a nop on FreeBSD, but is import for other
  platforms (or in the future) where PTHREAD_MUTEX_INITIALIZER is not simply
  zero.

PR:		threads/141198
Reported by:	Jeremy Huddleston @ Apple
MFC after:	2 weeks
2010-03-11 17:03:32 +00:00
Jaakko Heinonen
6ca7812a19 In _gettemp(), check that the length of the path doesn't exceed
MAXPATHLEN. Otherwise the path name (or part of it) may not fit to
carrybuf causing a buffer overflow.

PR:		bin/140228
Suggested by:	jilles
2010-02-28 13:31:29 +00:00
Ruslan Ermilov
e363756c8f %U was macroized in mdoc(7), escape. 2010-02-16 12:29:02 +00:00
Colin Percival
c6a96a8441 Give a less silly response to a silly request.
Prior to this commit, fread/fwrite calls with size * nmemb > SIZE_MAX
were handled by reading or writing (size_t)(size * nmemb) bytes; for
example, on 32-bit platforms, fread(ptr, 641, 6700417, f) would read 1
byte and indicate that the requested 6700417 blocks had been read.

This commit adds a check for such integer overflows, and treats them as
if an overly large request was passed to read/write; i.e., it sets errno
to EINVAL, sets the error indicator on the file, and returns a short
object count (0, to be specific).

The overflow check involves an integer division, so as a performance
optimization we check first to see if both size and nmemb are less than
2^16; if they are, no overflow is possible and we avoid the division.
We assume here that size_t is at least 32 bits; this appears to be true
on all platforms FreeBSD supports.

Although this commit fixes an integer overflow, it is not likely to have
any security implications, since any program which would be affected by
this bug fix is quite clearly already very confused.

Reviewed by:	kib
MFC after:	1 month
2010-01-10 14:30:30 +00:00
Christian Brueffer
37dc3d28cb Remove unnecessary quoting and markup, add missing punctuation.
PR:		140494
Submitted by:	Jeremy Huddleston <jeremyhu@apple.com>, bde
MFC after:	1 week
2010-01-08 22:02:42 +00:00