From owner-freebsd-bugs@FreeBSD.ORG Wed Apr 21 01:20:22 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 02BAD16A4D3 for ; Wed, 21 Apr 2004 01:20:22 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id C02C843D39 for ; Wed, 21 Apr 2004 01:20:21 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i3L8KLbv024598 for ; Wed, 21 Apr 2004 01:20:21 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.10/8.12.10/Submit) id i3L8KLxu024597; Wed, 21 Apr 2004 01:20:21 -0700 (PDT) (envelope-from gnats) Resent-Date: Wed, 21 Apr 2004 01:20:21 -0700 (PDT) Resent-Message-Id: <200404210820.i3L8KLxu024597@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Steven Smith Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2619F16A4CE for ; Wed, 21 Apr 2004 01:17:44 -0700 (PDT) Received: from yellow.csi.cam.ac.uk (yellow.csi.cam.ac.uk [131.111.8.67]) by mx1.FreeBSD.org (Postfix) with ESMTP id B052543D2D for ; Wed, 21 Apr 2004 01:17:43 -0700 (PDT) (envelope-from sos22@cam.ac.uk) Received: from archibold.chu.cam.ac.uk ([131.111.131.102]) by yellow.csi.cam.ac.uk with smtp (Exim 4.12) id 1BGCvO-0003ku-00 for FreeBSD-gnats-submit@freebsd.org; Wed, 21 Apr 2004 09:17:42 +0100 Received: by archibold.chu.cam.ac.uk (sSMTP sendmail emulation); Wed, _d Apr 2004 09:18:00 +0100 Message-Id: From: "Steven Smith" To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: misc/65841: [patch] vfprintf on CURRENT produces odd results when used with many arguments X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Steven Smith List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Date: Wed, 21 Apr 2004 08:20:22 -0000 X-Original-Date: Wed, _d Apr 2004 09:18:00 +0100 X-List-Received-Date: Wed, 21 Apr 2004 08:20:22 -0000 >Number: 65841 >Category: misc >Synopsis: [patch] vfprintf on CURRENT produces odd results when used with many arguments >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Apr 21 01:20:21 PDT 2004 >Closed-Date: >Last-Modified: >Originator: Steven Smith >Release: FreeBSD 5.2-CURRENT i386 >Organization: >Environment: System: FreeBSD archibold.chu.cam.ac.uk 5.2-CURRENT FreeBSD 5.2-CURRENT #14: Mon Apr 19 17:59:53 BST 2004 sos22@archibold.chu.cam.ac.uk:/usr/src/sys/i386/compile/ARCHYKERNEL i386 >Description: __grow_type_table in src/lib/libc/stdio/vfprintf.c treats tablesize as a byte count, whereas the rest of the code treats it as a count of the elements in an array. This causes problems if a large number of arguments are used in a printf format and some ``%5$d''-style escapes are used to refer to arguments by index. >How-To-Repeat: The attached program test.c produces output ``1 -791621424 -791621424 -791621424 -791621424 -791621424 -791621424 2'' >Fix: The attached patch printf.diff seems to fix the problem. Patch is against CVS version 1.63. --- test.c begins here --- #include int main() { printf("%1$d %2$d %3$d %4$d %5$d %6$d %7$d %8$d\n", 1,2,3,4,5,6,7,8); return 0; } --- test.c ends here --- --- printf.diff begins here --- Index: lib/libc/stdio/vfprintf.c =================================================================== RCS file: /home/ncvs/src/lib/libc/stdio/vfprintf.c,v retrieving revision 1.63 diff -u -w -r1.63 vfprintf.c --- lib/libc/stdio/vfprintf.c 7 Apr 2004 09:55:05 -0000 1.63 +++ lib/libc/stdio/vfprintf.c 21 Apr 2004 07:47:41 -0000 @@ -1595,14 +1595,15 @@ if (newsize < nextarg + 1) newsize = nextarg + 1; if (oldsize == STATIC_ARG_TBL_SIZE) { - if ((newtable = malloc(newsize)) == NULL) + if ((newtable = malloc(newsize * sizeof(enum typeid))) == NULL) abort(); /* XXX handle better */ - bcopy(oldtable, newtable, oldsize); + bcopy(oldtable, newtable, oldsize * sizeof(enum typeid)); } else { - if ((newtable = reallocf(oldtable, newsize)) == NULL) + newtable = reallocf(oldtable, newsize * sizeof(enum typeid)); + if (newtable == NULL) abort(); /* XXX handle better */ } - memset(&newtable[oldsize], T_UNUSED, newsize - oldsize); + memset(&newtable[oldsize], T_UNUSED, (newsize - oldsize) * sizeof(enum typeid)); *typetable = newtable; *tablesize = newsize; --- printf.diff ends here --- >Release-Note: >Audit-Trail: >Unformatted: