[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190314132921.GI26605@port70.net>
Date: Thu, 14 Mar 2019 14:29:21 +0100
From: Szabolcs Nagy <nsz@...t70.net>
To: musl@...ts.openwall.com
Cc: Natanael ncopa Copa <ncopa@...inelinux.org>,
Marian Buschsieweke <marian.buschsieweke@...u.de>
Subject: Re: segfault on sscanf
* A. Wilcox <awilfox@...lielinux.org> [2019-03-14 07:44:55 -0500]:
> On Mar 14, 2019, at 4:46 AM, Marian Buschsieweke <marian.buschsieweke@...u.de> wrote:
> > running pdflatex on Alpine Linux for a specific document resulted in a
> > segfault, which I could trace down to a specific call to sscanf. This is a
> > minimum example to reproduce that segfault:
> >
> > #include <stdio.h>
> >
> > int main(void) {
> > const char *too_parse = "0 1 -1 0";
> > double f1,f2,f3,f4;
> > char dummy;
> > sscanf(too_parse, " %lf %lf %lf %lf %c", &f1, &f2, &f3, &f4, &dummy);
> >
> > printf("f1=%f, f2=%f, f3=%f, f4=%f, dummy=\"%c\"\n", f1, f2, f3, f4, dummy);
> >
> > return 0;
> > }
> >
> > This is the backtrace:
> >
> > #0 0x00007ffff7fb7eba in vfscanf (f=f@...ry=0x7fffffffe6f8,
> > fmt=<optimized out>, ap=ap@...ry=0x7fffffffe7f8) at src/stdio/vfscanf.c:262
> > #1 0x00007ffff7fb971a in vsscanf (s=<optimized out>, fmt=<optimized out>,
> > ap=ap@...ry=0x7fffffffe7f8) at src/stdio/vsscanf.c:14
> > #2 0x00007ffff7fb594d in sscanf (s=<optimized out>, fmt=<optimized out>)
> > at src/stdio/sscanf.c:9
> > #3 0x0000555555555213 in main () at test.c:7
> >
> > I have the package Alpine Linux package musl-1.1.21-r0 installed, which is musl
> > version 1.1.21 with minimal changes.
> >
> > Kind regards,
> > Marian
>
> Hi Marian,
>
> In your example you have four fields, but sscanf is looking for five. You have run off the end of the string. This is illegal/UB. Is this intentional in your test case?
the example does not look undefined to me.
7.21.6.7p3
The sscanf function returns the value of the macro EOF if an input
failure occurs before the first conversion (if any) has completed.
Otherwise, the sscanf function returns the number of input items
assigned, which can be fewer than provided for, or even zero, in
the event of an early matching failure.
invalid format specifier, invalid argument type or overflow during
conversion would be undefined, but input parsing error is not.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
