Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <5613D23A.3010707@gmail.com>
Date: Tue, 6 Oct 2015 16:52:58 +0300
From: Maxim Storchak <m.storchak@...il.com>
To: musl@...ts.openwall.com
Subject: open_memstream corner case

Hi,

I discovered something strange with memstream subsystem in musl: if a
stream is opened for writing with open_memstream(3) but then closed
without writing anything, neither buffer pointer, nor buffer size gets
updated. I compared source code of glibc, uClibc and musl and discovered
that both uClibc and musl update buffer size on write, while glibc does
that on fclose or fsync, both of which is fine, according to
memstream(3) man page. While both uClibc and musl behave the same if
something is written to the buffer, they differ if no write happens. On
initialization uClibc sets buffer size to 0, and musl leaves it intact.
In case of no write it doesn't get updated and contains garbage. Here is
my test case:

#include <stdio.h>
#include <stdlib.h>
int main() {
        FILE *f;
        size_t size=-42; /* garbage */
        char *buf="garbage";
        printf("Initially: size=%ld, buf=%s\n", size, buf);
        if ( (f=open_memstream(&buf, &size)) == NULL ) {
                perror("open_memstream");
                exit(0);
        }
        fclose(f);
        printf("After writing nothing to buffer: size=%ld, buf=%s\n",
size, buf);
        if ( (f=open_memstream(&buf, &size)) == NULL ) {
                perror("open_memstream");
                exit(0);
        }
        fprintf(f, "something completely different");
        fclose(f);
        printf("After writing something to buffer: size=%ld, buf=%s\n",
size, buf);
        exit(0);
}

musl:
Initially: size=-42, buf=garbage
After writing nothing to buffer: size=-42, buf=garbage
After writing something to buffer: size=30, buf=something completely
different

glibc:
Initially: size=-42, buf=garbage
After writing nothing to buffer: size=0, buf=
After writing something to buffer: size=30, buf=something completely
different

(I'm sorry for providing no example for uClibc, but the program where I
found that use case used to work with uClibc but not musl).

Could anyone please comment if where's a bug in musl or in my test case?

-- 
Best regards,
Maxim Storchak
mailto:m.storchak@...il.com

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.