From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Paul Eggert Newsgroups: gmane.emacs.bugs Subject: bug#9412: sprintf-related integer and memory overflow issues Date: Wed, 31 Aug 2011 15:21:37 -0700 Organization: UCLA Computer Science Department Message-ID: <4E5EB3F1.5030906@cs.ucla.edu> References: <4E5D6772.7060208@cs.ucla.edu> <87vcteib8y.fsf@stupidchicken.com> <4E5DCE9B.9060903@cs.ucla.edu> <871uw136ei.fsf@stupidchicken.com> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Trace: dough.gmane.org 1314829377 26956 80.91.229.12 (31 Aug 2011 22:22:57 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Wed, 31 Aug 2011 22:22:57 +0000 (UTC) Cc: 9412@debbugs.gnu.org To: Chong Yidong Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Thu Sep 01 00:22:52 2011 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([140.186.70.17]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1QytBM-0003oQ-Je for geb-bug-gnu-emacs@m.gmane.org; Thu, 01 Sep 2011 00:22:52 +0200 Original-Received: from localhost ([::1]:54078 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QytBL-000708-Qw for geb-bug-gnu-emacs@m.gmane.org; Wed, 31 Aug 2011 18:22:51 -0400 Original-Received: from eggs.gnu.org ([140.186.70.92]:49342) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QytBI-0006zz-HN for bug-gnu-emacs@gnu.org; Wed, 31 Aug 2011 18:22:49 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QytBH-0005H7-Dz for bug-gnu-emacs@gnu.org; Wed, 31 Aug 2011 18:22:48 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:37837) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QytBH-0005H3-B6 for bug-gnu-emacs@gnu.org; Wed, 31 Aug 2011 18:22:47 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.69) (envelope-from ) id 1QytEQ-000489-AF; Wed, 31 Aug 2011 18:26:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Paul Eggert Original-Sender: debbugs-submit-bounces@debbugs.gnu.org Resent-To: owner@debbugs.gnu.org Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Wed, 31 Aug 2011 22:26:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 9412 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 9412-submit@debbugs.gnu.org id=B9412.131482950415800 (code B ref 9412); Wed, 31 Aug 2011 22:26:02 +0000 Original-Received: (at 9412) by debbugs.gnu.org; 31 Aug 2011 22:25:04 +0000 Original-Received: from localhost ([127.0.0.1] helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1QytDU-00046m-6M for submit@debbugs.gnu.org; Wed, 31 Aug 2011 18:25:04 -0400 Original-Received: from smtp.cs.ucla.edu ([131.179.128.62]) by debbugs.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1QytDR-00046O-Ok for 9412@debbugs.gnu.org; Wed, 31 Aug 2011 18:25:03 -0400 Original-Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp.cs.ucla.edu (Postfix) with ESMTP id 9C11A39E80DA; Wed, 31 Aug 2011 15:21:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at smtp.cs.ucla.edu Original-Received: from smtp.cs.ucla.edu ([127.0.0.1]) by localhost (smtp.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QY8nkLGbhL7c; Wed, 31 Aug 2011 15:21:44 -0700 (PDT) Original-Received: from [131.179.64.200] (Penguin.CS.UCLA.EDU [131.179.64.200]) by smtp.cs.ucla.edu (Postfix) with ESMTPSA id CF02D39E80D2; Wed, 31 Aug 2011 15:21:44 -0700 (PDT) User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.20) Gecko/20110817 Fedora/3.1.12-1.fc14 Thunderbird/3.1.12 In-Reply-To: <871uw136ei.fsf@stupidchicken.com> X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.11 Precedence: list Resent-Date: Wed, 31 Aug 2011 18:26:02 -0400 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 1) X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:50503 Archived-At: On 08/31/11 09:14, Chong Yidong wrote: > I'm not clear on this issue of sprintf etc being restricted to 2GB. > Could you explain further? sprintf returns an 'int' counting the number of bytes it outputs. If this count would exceed INT_MAX, sprintf returns -1 and sets errno. sprintf therefore cannot be used to create a string that might be longer than INT_MAX bytes. On typical 64-bit hosts, this is an arbitrary 2 GiB limit, which Emacs shouldn't have. > Surely such a limitation is a bug in the C library, not Emacs? > If so, it should be fixed there, not in Emacs. I agree, but unfortunately the problem is inherent to sprintf's type signature, which has been stable for many years and is not slated to be improved or extended even in C1X. It would take decades before we could assume any such fix would be present in the C library. > sprintf (and snprintf) is a well-known function; when someone comes > across it in the code, it's not necessary to look it up to know what > it's doing. True, but surely it's not too much to ask Emacs developers to remember that esprintf is like sprintf, except without the 2 GiB limit. Emacs developers already deal with similar printf-like functions ('message', 'error', etc.) and this sort of thing is nothing new. I wouldn't be suggesting esprintf if it weren't for the 2 GiB limit. > I think we should add a stub for snprintf in sysdep.c for the > !HAVE_SNPRINTF case (which will need configure to set up HAVE_SNPRINTF). Sure, that's easily done, with the following additional patch. I'll CC: this to Eli since it adds a #define to nt/config.nt. === modified file 'ChangeLog' --- ChangeLog 2011-08-30 20:46:59 +0000 +++ ChangeLog 2011-08-31 22:18:16 +0000 @@ -1,3 +1,7 @@ +2011-08-31 Paul Eggert + + * configure.in (snprintf): New check. + 2011-08-30 Paul Eggert * configure.in (opsys): Change pattern to *-*-linux* === modified file 'configure.in' --- configure.in 2011-08-30 20:46:59 +0000 +++ configure.in 2011-08-31 22:18:16 +0000 @@ -3071,6 +3071,8 @@ AC_FUNC_FORK +AC_CHECK_FUNCS(snprintf) + dnl Adapted from Haible's version. AC_CACHE_CHECK([for nl_langinfo and CODESET], emacs_cv_langinfo_codeset, [AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], === modified file 'nt/ChangeLog' --- nt/ChangeLog 2011-07-28 00:48:01 +0000 +++ nt/ChangeLog 2011-08-31 22:18:16 +0000 @@ -1,3 +1,7 @@ +2011-08-31 Paul Eggert + + * config.nt (HAVE_SNPRINTF): New macro. + 2011-07-28 Paul Eggert Assume freestanding C89 headers, string.h, stdlib.h. === modified file 'nt/config.nt' --- nt/config.nt 2011-07-07 01:32:56 +0000 +++ nt/config.nt 2011-08-31 22:18:16 +0000 @@ -240,6 +240,7 @@ #define HAVE_SETSOCKOPT 1 #define HAVE_GETSOCKNAME 1 #define HAVE_GETPEERNAME 1 +#define HAVE_SNPRINTF 1 #define HAVE_LANGINFO_CODESET 1 /* Local (unix) sockets are not supported. */ #undef HAVE_SYS_UN_H === modified file 'src/ChangeLog' --- src/ChangeLog 2011-08-31 20:02:51 +0000 +++ src/ChangeLog 2011-08-31 22:18:16 +0000 @@ -90,6 +90,8 @@ * process.c (make_process): Use printmax_t, not int, to format process-name gensyms. + * sysdep.c (snprintf) [! HAVE_SNPRINTF]: New function. + * term.c (produce_glyphless_glyph): Make sprintf buffer a bit bigger to avoid potential buffer overrun. === modified file 'src/sysdep.c' --- src/sysdep.c 2011-07-29 01:16:54 +0000 +++ src/sysdep.c 2011-08-31 22:18:16 +0000 @@ -1811,6 +1811,45 @@ } #endif /* not WINDOWSNT */ #endif /* ! HAVE_STRERROR */ + +#ifndef HAVE_SNPRINTF +/* Approximate snprintf as best we can on ancient hosts that lack it. */ +int +snprintf (char *buf, size_t bufsize, char const *format, ...) +{ + ptrdiff_t size = min (bufsize, PTRDIFF_MAX); + ptrdiff_t nbytes = size - 1; + va_list ap; + + if (size) + { + va_start (ap, format); + nbytes = doprnt (buf, size, format, 0, ap); + va_end (ap); + } + + if (nbytes == size - 1) + { + /* Calculate the length of the string that would have been created + had the buffer been large enough. */ + char stackbuf[4000]; + char *b = stackbuf; + ptrdiff_t bsize = sizeof stackbuf; + va_start (ap, format); + nbytes = evxprintf (&b, &bsize, stackbuf, -1, format, ap); + va_end (ap); + if (b != stackbuf) + xfree (b); + } + + if (INT_MAX < nbytes) + { + errno = EOVERFLOW; + return -1; + } + return nbytes; +} +#endif int emacs_open (const char *path, int oflag, int mode)