1d4c55
commit 29b12753b51866b227a6c0ac96c2c6c0e20f3497
1d4c55
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
1d4c55
Date:   Thu Mar 19 18:35:46 2020 -0300
1d4c55
1d4c55
    stdio: Add tests for printf multibyte convertion leak [BZ#25691]
1d4c55
    
1d4c55
    Checked on x86_64-linux-gnu and i686-linux-gnu.
1d4c55
    
1d4c55
    (cherry picked from commit 910a835dc96c1f518ac2a6179fc622ba81ffb159)
1d4c55
1d4c55
diff --git a/stdio-common/Makefile b/stdio-common/Makefile
1d4c55
index a10f12ab3ccbd76e..51062a7dbf698931 100644
1d4c55
--- a/stdio-common/Makefile
1d4c55
+++ b/stdio-common/Makefile
1d4c55
@@ -63,6 +63,7 @@ tests := tstscanf test_rdwr test-popen tstgetln test-fseek \
1d4c55
 	 tst-vfprintf-mbs-prec \
1d4c55
 	 tst-scanf-round \
1d4c55
 	 tst-renameat2 \
1d4c55
+	 tst-printf-bz25691 \
1d4c55
 
1d4c55
 test-srcs = tst-unbputc tst-printf tst-printfsz-islongdouble
1d4c55
 
1d4c55
@@ -71,10 +72,12 @@ tests-special += $(objpfx)tst-unbputc.out $(objpfx)tst-printf.out \
1d4c55
 		 $(objpfx)tst-printf-bz18872-mem.out \
1d4c55
 		 $(objpfx)tst-setvbuf1-cmp.out \
1d4c55
 		 $(objpfx)tst-vfprintf-width-prec-mem.out \
1d4c55
-		 $(objpfx)tst-printfsz-islongdouble.out
1d4c55
+		 $(objpfx)tst-printfsz-islongdouble.out \
1d4c55
+		 $(objpfx)tst-printf-bz25691-mem.out
1d4c55
 generated += tst-printf-bz18872.c tst-printf-bz18872.mtrace \
1d4c55
 	     tst-printf-bz18872-mem.out \
1d4c55
-	     tst-vfprintf-width-prec.mtrace tst-vfprintf-width-prec-mem.out
1d4c55
+	     tst-vfprintf-width-prec.mtrace tst-vfprintf-width-prec-mem.out \
1d4c55
+	     tst-printf-bz25691.mtrace tst-printf-bz25691-mem.out
1d4c55
 endif
1d4c55
 
1d4c55
 include ../Rules
1d4c55
@@ -96,6 +99,8 @@ endif
1d4c55
 tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace
1d4c55
 tst-vfprintf-width-prec-ENV = \
1d4c55
   MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace
1d4c55
+tst-printf-bz25691-ENV = \
1d4c55
+  MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace
1d4c55
 
1d4c55
 $(objpfx)tst-unbputc.out: tst-unbputc.sh $(objpfx)tst-unbputc
1d4c55
 	$(SHELL) $< $(common-objpfx) '$(test-program-prefix)' > $@; \
1d4c55
diff --git a/stdio-common/tst-printf-bz25691.c b/stdio-common/tst-printf-bz25691.c
1d4c55
new file mode 100644
1d4c55
index 0000000000000000..37b30a3a8a7dc5e2
1d4c55
--- /dev/null
1d4c55
+++ b/stdio-common/tst-printf-bz25691.c
1d4c55
@@ -0,0 +1,108 @@
1d4c55
+/* Test for memory leak with large width (BZ#25691).
1d4c55
+   Copyright (C) 2020 Free Software Foundation, Inc.
1d4c55
+   This file is part of the GNU C Library.
1d4c55
+
1d4c55
+   The GNU C Library is free software; you can redistribute it and/or
1d4c55
+   modify it under the terms of the GNU Lesser General Public
1d4c55
+   License as published by the Free Software Foundation; either
1d4c55
+   version 2.1 of the License, or (at your option) any later version.
1d4c55
+
1d4c55
+   The GNU C Library is distributed in the hope that it will be useful,
1d4c55
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
1d4c55
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
1d4c55
+   Lesser General Public License for more details.
1d4c55
+
1d4c55
+   You should have received a copy of the GNU Lesser General Public
1d4c55
+   License along with the GNU C Library; if not, see
1d4c55
+   <https://www.gnu.org/licenses/>.  */
1d4c55
+
1d4c55
+#include <stdio.h>
1d4c55
+#include <stdlib.h>
1d4c55
+#include <string.h>
1d4c55
+#include <wchar.h>
1d4c55
+#include <stdint.h>
1d4c55
+#include <locale.h>
1d4c55
+
1d4c55
+#include <mcheck.h>
1d4c55
+#include <support/check.h>
1d4c55
+#include <support/support.h>
1d4c55
+
1d4c55
+static int
1d4c55
+do_test (void)
1d4c55
+{
1d4c55
+  mtrace ();
1d4c55
+
1d4c55
+  /* For 's' conversion specifier with 'l' modifier the array must be
1d4c55
+     converted to multibyte characters up to the precision specific
1d4c55
+     value.  */
1d4c55
+  {
1d4c55
+    /* The input size value is to force a heap allocation on temporary
1d4c55
+       buffer (in the old implementation).  */
1d4c55
+    const size_t winputsize = 64 * 1024 + 1;
1d4c55
+    wchar_t *winput = xmalloc (winputsize * sizeof (wchar_t));
1d4c55
+    wmemset (winput, L'a', winputsize - 1);
1d4c55
+    winput[winputsize - 1] = L'\0';
1d4c55
+
1d4c55
+    char result[9];
1d4c55
+    const char expected[] = "aaaaaaaa";
1d4c55
+    int ret;
1d4c55
+
1d4c55
+    ret = snprintf (result, sizeof (result), "%.65537ls", winput);
1d4c55
+    TEST_COMPARE (ret, winputsize - 1);
1d4c55
+    TEST_COMPARE_BLOB (result, sizeof (result), expected, sizeof (expected));
1d4c55
+
1d4c55
+    ret = snprintf (result, sizeof (result), "%ls", winput);
1d4c55
+    TEST_COMPARE (ret, winputsize - 1);
1d4c55
+    TEST_COMPARE_BLOB (result, sizeof (result), expected, sizeof (expected));
1d4c55
+
1d4c55
+    free (winput);
1d4c55
+  }
1d4c55
+
1d4c55
+  /* For 's' converstion specifier the array is interpreted as a multibyte
1d4c55
+     character sequence and converted to wide characters up to the precision
1d4c55
+     specific value.  */
1d4c55
+  {
1d4c55
+    /* The input size value is to force a heap allocation on temporary
1d4c55
+       buffer (in the old implementation).  */
1d4c55
+    const size_t mbssize = 32 * 1024;
1d4c55
+    char *mbs = xmalloc (mbssize);
1d4c55
+    memset (mbs, 'a', mbssize - 1);
1d4c55
+    mbs[mbssize - 1] = '\0';
1d4c55
+
1d4c55
+    const size_t expectedsize = 32 * 1024;
1d4c55
+    wchar_t *expected = xmalloc (expectedsize * sizeof (wchar_t));
1d4c55
+    wmemset (expected, L'a', expectedsize - 1);
1d4c55
+    expected[expectedsize-1] = L'\0';
1d4c55
+
1d4c55
+    const size_t resultsize = mbssize * sizeof (wchar_t);
1d4c55
+    wchar_t *result = xmalloc (resultsize);
1d4c55
+    int ret;
1d4c55
+
1d4c55
+    ret = swprintf (result, resultsize, L"%.65537s", mbs);
1d4c55
+    TEST_COMPARE (ret, mbssize - 1);
1d4c55
+    TEST_COMPARE_BLOB (result, (ret + 1) * sizeof (wchar_t),
1d4c55
+		       expected, expectedsize * sizeof (wchar_t));
1d4c55
+
1d4c55
+    ret = swprintf (result, resultsize, L"%1$.65537s", mbs);
1d4c55
+    TEST_COMPARE (ret, mbssize - 1);
1d4c55
+    TEST_COMPARE_BLOB (result, (ret + 1) * sizeof (wchar_t),
1d4c55
+		       expected, expectedsize * sizeof (wchar_t));
1d4c55
+
1d4c55
+    /* Same test, but with an invalid multibyte sequence.  */
1d4c55
+    mbs[mbssize - 2] = 0xff;
1d4c55
+
1d4c55
+    ret = swprintf (result, resultsize, L"%.65537s", mbs);
1d4c55
+    TEST_COMPARE (ret, -1);
1d4c55
+
1d4c55
+    ret = swprintf (result, resultsize, L"%1$.65537s", mbs);
1d4c55
+    TEST_COMPARE (ret, -1);
1d4c55
+
1d4c55
+    free (mbs);
1d4c55
+    free (result);
1d4c55
+    free (expected);
1d4c55
+  }
1d4c55
+
1d4c55
+  return 0;
1d4c55
+}
1d4c55
+
1d4c55
+#include <support/test-driver.c>