misc/65841: [patch] vfprintf on CURRENT produces odd results when used with many arguments

[Steven Smith]

>Number:         65841
>Category:       misc
>Synopsis:       [patch] vfprintf on CURRENT produces odd results when used with many arguments
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 21 01:20:21 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Steven Smith
>Release:        FreeBSD 5.2-CURRENT i386
>Organization:
>Environment:
System: FreeBSD archibold.chu.cam.ac.uk 5.2-CURRENT FreeBSD 5.2-CURRENT #14: Mon Apr 19 17:59:53 BST 2004 sos22 at archibold.chu.cam.ac.uk:/usr/src/sys/i386/compile/ARCHYKERNEL i386


>Description:
	__grow_type_table in src/lib/libc/stdio/vfprintf.c treats tablesize
	as a byte count, whereas the rest of the code treats it as a
	count of the elements in an array.  This causes problems if a
	large number of arguments are used in a printf format and some
	``%5$d''-style escapes are used to refer to arguments by index.

>How-To-Repeat:
	The attached program test.c produces output
	``1 -791621424 -791621424 -791621424 -791621424 -791621424 -791621424 2''

>Fix:
	The attached patch printf.diff seems to fix the problem.  Patch is
	against CVS version 1.63.

--- test.c begins here ---
#include <stdio.h>

int
main()
{
	printf("%1$d %2$d %3$d %4$d %5$d %6$d %7$d %8$d\n",
	       1,2,3,4,5,6,7,8);
	return 0;
}
--- test.c ends here ---

--- printf.diff begins here ---
Index: lib/libc/stdio/vfprintf.c
===================================================================
RCS file: /home/ncvs/src/lib/libc/stdio/vfprintf.c,v
retrieving revision 1.63
diff -u -w -r1.63 vfprintf.c
--- lib/libc/stdio/vfprintf.c	7 Apr 2004 09:55:05 -0000	1.63
+++ lib/libc/stdio/vfprintf.c	21 Apr 2004 07:47:41 -0000
@@ -1595,14 +1595,15 @@
 	if (newsize < nextarg + 1)
 		newsize = nextarg + 1;
 	if (oldsize == STATIC_ARG_TBL_SIZE) {
-		if ((newtable = malloc(newsize)) == NULL)
+		if ((newtable = malloc(newsize * sizeof(enum typeid))) == NULL)
 			abort();			/* XXX handle better */
-		bcopy(oldtable, newtable, oldsize);
+		bcopy(oldtable, newtable, oldsize * sizeof(enum typeid));
 	} else {
-		if ((newtable = reallocf(oldtable, newsize)) == NULL)
+		newtable = reallocf(oldtable, newsize * sizeof(enum typeid));
+		if (newtable == NULL)
 			abort();			/* XXX handle better */
 	}
-	memset(&newtable[oldsize], T_UNUSED, newsize - oldsize);
+	memset(&newtable[oldsize], T_UNUSED, (newsize - oldsize) * sizeof(enum typeid));
 
 	*typetable = newtable;
 	*tablesize = newsize;
--- printf.diff ends here ---


>Release-Note:
>Audit-Trail:
>Unformatted: