diff options
| author | Eric Biggers <ebiggers3@gmail.com> | 2013-10-11 22:29:38 +0530 |
|---|---|---|
| committer | Siddhesh Poyarekar <siddhesh@redhat.com> | 2013-10-11 22:29:38 +0530 |
| commit | 3d110c7c6e6549bd4124fce49cdc672f9e449799 (patch) | |
| tree | 465a14f8a2e1c8e58f470c2550a524fff481228e /ChangeLog | |
| parent | 75b4202ab03337edb37536e3d9470a48a04c9341 (diff) | |
| download | glibc-3d110c7c6e6549bd4124fce49cdc672f9e449799.tar glibc-3d110c7c6e6549bd4124fce49cdc672f9e449799.tar.gz glibc-3d110c7c6e6549bd4124fce49cdc672f9e449799.tar.bz2 glibc-3d110c7c6e6549bd4124fce49cdc672f9e449799.zip | |
Fix fwrite() reading beyond end of buffer in error path
Partially revert commits 2b766585f9b4ffabeef2f36200c275976b93f2c7 and
de2fd463b1c0310d75084b6d774fb974075a4ad9, which were intended to fix BZ#11741
but caused another, likely worse bug, namely that fwrite() and fputs() could,
in an error path, read data beyond the end of the specified buffer, and
potentially even write this data to the file.
Fix BZ#11741 properly by checking the return value from _IO_padn() in
stdio-common/vfprintf.c.
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 17 |
1 files changed, 17 insertions, 0 deletions
@@ -1,3 +1,20 @@ +2013-10-11 Eric Biggers <ebiggers3@gmail.com> + + [BZ #15362] + * libio/fileops.c (_IO_new_file_write): Return count of bytes + written. + (_IO_new_file_xsputn): Don't return EOF if nothing has been + written. + * libio/iofwrite.c (_IO_fwrite): Return count if bytes were + written to buffer but not flushed. + * libio/iofwrite_u.c: Likewise. + * libio/iopadn.c: Return bytes returned even if EOF was + encountered. + * libio/iowpadn.c: Likewise. + * stdio-common/vfprintf.c [COMPILE_WPRINTF] (PAD): Return error + if _IO_padn does not write the whole buffer. + [!COMPILE_WPRINTF] (PAD): Likewise. + 2013-10-10 David S. Miller <davem@davemloft.net> * sysdeps/posix/dirstream.h (struct __dirstream): Fix alignment of |