Blame SOURCES/glibc-rh794817-2.patch

b40826
diff -rup a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
b40826
--- a/stdio-common/vfprintf.c	2012-03-05 09:43:14.705536167 -0700
b40826
+++ b/stdio-common/vfprintf.c	2012-03-05 09:48:11.602890982 -0700
b40826
@@ -822,7 +822,7 @@ vfprintf (FILE *s, const CHAR_T *format,
b40826
 									      \
b40826
 	if (function_done < 0)						      \
b40826
 	  {								      \
b40826
-	    /* Error in print handler.  */				      \
b40826
+	    /* Error in print handler; up to handler to set errno.  */	      \
b40826
 	    done = -1;							      \
b40826
 	    goto all_done;						      \
b40826
 	  }								      \
b40826
@@ -876,7 +876,7 @@ vfprintf (FILE *s, const CHAR_T *format,
b40826
 									      \
b40826
 	if (function_done < 0)						      \
b40826
 	  {								      \
b40826
-	    /* Error in print handler.  */				      \
b40826
+	    /* Error in print handler; up to handler to set errno.  */	      \
b40826
 	    done = -1;							      \
b40826
 	    goto all_done;						      \
b40826
 	  }								      \
b40826
@@ -1117,7 +1117,7 @@ vfprintf (FILE *s, const CHAR_T *format,
b40826
 			 &mbstate);					      \
b40826
 	if (len == (size_t) -1)						      \
b40826
 	  {								      \
b40826
-	    /* Something went wron gduring the conversion.  Bail out.  */     \
b40826
+	    /* Something went wrong during the conversion.  Bail out.  */     \
b40826
 	    done = -1;							      \
b40826
 	    goto all_done;						      \
b40826
 	  }								      \
b40826
@@ -1188,6 +1188,7 @@ vfprintf (FILE *s, const CHAR_T *format,
b40826
 		      if (__mbsnrtowcs (ignore, &str2, strend - str2,	      \
b40826
 					ignore_size, &ps) == (size_t) -1)     \
b40826
 			{						      \
b40826
+			  /* Conversion function has set errno.  */	      \
b40826
 			  done = -1;					      \
b40826
 			  goto all_done;				      \
b40826
 			}						      \
b40826
@@ -1599,6 +1600,7 @@ vfprintf (FILE *s, const CHAR_T *format,
b40826
 	  if (spec == L_('\0'))
b40826
 	    {
b40826
 	      /* The format string ended before the specifier is complete.  */
b40826
+	      __set_errno (EINVAL);
b40826
 	      done = -1;
b40826
 	      goto all_done;
b40826
 	    }
b40826
@@ -1696,17 +1698,20 @@ do_positional:
b40826
 
b40826
     /* Determine the number of arguments the format string consumes.  */
b40826
     nargs = MAX (nargs, max_ref_arg);
b40826
+    /* Calculate total size needed to represent a single argument across
b40826
+       all three argument-related arrays.  */
b40826
     bytes_per_arg = sizeof (*args_value) + sizeof (*args_size)
b40826
                     + sizeof (*args_type);
b40826
 
b40826
     /* Check for potential integer overflow.  */
b40826
-    if (nargs > SIZE_MAX / bytes_per_arg)
b40826
+    if (__builtin_expect (nargs > SIZE_MAX / bytes_per_arg, 0))
b40826
       {
b40826
+         __set_errno (ERANGE);
b40826
          done = -1;
b40826
          goto all_done;
b40826
       }
b40826
 
b40826
-    /* Allocate memory for the argument descriptions.  */
b40826
+    /* Allocate memory for all three argument arrays.  */
b40826
     if (__libc_use_alloca (nargs * bytes_per_arg))
b40826
         args_value = alloca (nargs * bytes_per_arg);
b40826
     else
b40826
@@ -1937,6 +1942,7 @@ do_positional:
b40826
 		       about # of chars.  */
b40826
 		    if (function_done < 0)
b40826
 		      {
b40826
+			/* Function has set errno.  */
b40826
 			done = -1;
b40826
 			goto all_done;
b40826
 		      }
b40826
@@ -1971,6 +1977,7 @@ do_positional:
b40826
 		 of chars.  */
b40826
 	      if (function_done < 0)
b40826
 		{
b40826
+		  /* Function has set errno.  */
b40826
 		  done = -1;
b40826
 		  goto all_done;
b40826
 		}