From 4a9921c601c7e7215a57606b0ac3bfd6d56516c0 Mon Sep 17 00:00:00 2001 From: "Andrey A. Chernov" Date: Mon, 5 Sep 2016 04:49:58 +0000 Subject: [PATCH] 1) Prevent out of bounds access to ws[-1] (passed buffer) which happens when the first mb sequence is incomplete and there are not enougn chars in the read buffer. ws[-1] may lead to memory faults or false results, in case the memory here contains '\n'. 2) Fix EOF checking I mess in my previos r305406 commit. MFC after: 3 days --- lib/libc/stdio/fgetws.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/libc/stdio/fgetws.c b/lib/libc/stdio/fgetws.c index b12a38aad788..efff8385b3e3 100644 --- a/lib/libc/stdio/fgetws.c +++ b/lib/libc/stdio/fgetws.c @@ -93,7 +93,7 @@ fgetws_l(wchar_t * __restrict ws, int n, FILE * __restrict fp, locale_t locale) fp->_p = (unsigned char *)src; n -= nconv; wsp += nconv; - } while (wsp[-1] != L'\n' && n > 1 && (fp->_r > 0 || + } while ((wsp == ws || wsp[-1] != L'\n') && n > 1 && (fp->_r > 0 || (sret = __srefill(fp)) == 0)); if (sret && !__sfeof(fp)) /* ferror */ @@ -104,7 +104,7 @@ fgetws_l(wchar_t * __restrict ws, int n, FILE * __restrict fp, locale_t locale) errno = EILSEQ; goto error; } - if (sret) + if (wsp == ws) /* EOF */ goto error; *wsp = L'\0';