diff mbox series

[v2] stdlib: Fix __libc_message_impl iovec size (BZ 32947)

Message ID 20250508130732.2068630-1-adhemerval.zanella@linaro.org
State New
Headers show
Series [v2] stdlib: Fix __libc_message_impl iovec size (BZ 32947) | expand

Commit Message

Adhemerval Zanella May 8, 2025, 1:07 p.m. UTC 
The iovec size should account for all substrings between each conversion
specification.  For the format:

  "abc %s efg"

The list of substrings are:

  ["abc ", arg, " efg]

which is 2 times the number of maximum arguments *plus* one.

This issue triggered 'out of bounds' errors by stdlib/tst-bz20544 when
glibc is built with experimental UBSAN support [1].

Checked on x86_64-linux-gnu.

[1] https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/azanella/ubsan-undef
--
Changes from v1:
* Add bug report.
---
 sysdeps/posix/libc_fatal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c
index d90cc6c681..25ef20cfc1 100644
--- a/sysdeps/posix/libc_fatal.c
+++ b/sysdeps/posix/libc_fatal.c
@@ -61,7 +61,7 @@  __libc_message_impl (const char *fmt, ...)
   if (fd == -1)
     fd = STDERR_FILENO;
 
-  struct iovec iov[LIBC_MESSAGE_MAX_ARGS * 2 - 1];
+  struct iovec iov[LIBC_MESSAGE_MAX_ARGS * 2 + 1];
   int iovcnt = 0;
   ssize_t total = 0;