re_search_internal: Avoid overflow in computing re_malloc buffer size
[glibc.git] / libio / vsnprintf.c
bloba05eb5455c13681f1cd9b0055aa75d77ed025169
1 /* Copyright (C) 1994,1997,1999-2004,2006,2009 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
4 The GNU C Library is free software; you can redistribute it and/or
5 modify it under the terms of the GNU Lesser General Public
6 License as published by the Free Software Foundation; either
7 version 2.1 of the License, or (at your option) any later version.
9 The GNU C Library is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 Lesser General Public License for more details.
14 You should have received a copy of the GNU Lesser General Public
15 License along with the GNU C Library; if not, write to the Free
16 Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
17 02111-1307 USA.
19 As a special exception, if you link the code in this file with
20 files compiled with a GNU compiler to produce an executable,
21 that does not cause the resulting executable to be covered by
22 the GNU Lesser General Public License. This exception does not
23 however invalidate any other reasons why the executable file
24 might be covered by the GNU Lesser General Public License.
25 This exception applies to code released by its copyright holders
26 in files containing the exception. */
28 #include "libioP.h"
29 #include "strfile.h"
31 static int _IO_strn_overflow (_IO_FILE *fp, int c) __THROW;
33 static int
34 _IO_strn_overflow (fp, c)
35 _IO_FILE *fp;
36 int c;
38 /* When we come to here this means the user supplied buffer is
39 filled. But since we must return the number of characters which
40 would have been written in total we must provide a buffer for
41 further use. We can do this by writing on and on in the overflow
42 buffer in the _IO_strnfile structure. */
43 _IO_strnfile *snf = (_IO_strnfile *) fp;
45 if (fp->_IO_buf_base != snf->overflow_buf)
47 /* Terminate the string. We know that there is room for at
48 least one more character since we initialized the stream with
49 a size to make this possible. */
50 *fp->_IO_write_ptr = '\0';
52 INTUSE(_IO_setb) (fp, snf->overflow_buf,
53 snf->overflow_buf + sizeof (snf->overflow_buf), 0);
55 fp->_IO_write_base = snf->overflow_buf;
56 fp->_IO_read_base = snf->overflow_buf;
57 fp->_IO_read_ptr = snf->overflow_buf;
58 fp->_IO_read_end = snf->overflow_buf + sizeof (snf->overflow_buf);
61 fp->_IO_write_ptr = snf->overflow_buf;
62 fp->_IO_write_end = snf->overflow_buf;
64 /* Since we are not really interested in storing the characters
65 which do not fit in the buffer we simply ignore it. */
66 return c;
70 const struct _IO_jump_t _IO_strn_jumps attribute_hidden =
72 JUMP_INIT_DUMMY,
73 JUMP_INIT(finish, _IO_str_finish),
74 JUMP_INIT(overflow, _IO_strn_overflow),
75 JUMP_INIT(underflow, INTUSE(_IO_str_underflow)),
76 JUMP_INIT(uflow, INTUSE(_IO_default_uflow)),
77 JUMP_INIT(pbackfail, INTUSE(_IO_str_pbackfail)),
78 JUMP_INIT(xsputn, INTUSE(_IO_default_xsputn)),
79 JUMP_INIT(xsgetn, INTUSE(_IO_default_xsgetn)),
80 JUMP_INIT(seekoff, INTUSE(_IO_str_seekoff)),
81 JUMP_INIT(seekpos, _IO_default_seekpos),
82 JUMP_INIT(setbuf, _IO_default_setbuf),
83 JUMP_INIT(sync, _IO_default_sync),
84 JUMP_INIT(doallocate, INTUSE(_IO_default_doallocate)),
85 JUMP_INIT(read, _IO_default_read),
86 JUMP_INIT(write, _IO_default_write),
87 JUMP_INIT(seek, _IO_default_seek),
88 JUMP_INIT(close, _IO_default_close),
89 JUMP_INIT(stat, _IO_default_stat),
90 JUMP_INIT(showmanyc, _IO_default_showmanyc),
91 JUMP_INIT(imbue, _IO_default_imbue)
95 int
96 _IO_vsnprintf (string, maxlen, format, args)
97 char *string;
98 _IO_size_t maxlen;
99 const char *format;
100 _IO_va_list args;
102 _IO_strnfile sf;
103 int ret;
104 #ifdef _IO_MTSAFE_IO
105 sf.f._sbf._f._lock = NULL;
106 #endif
108 /* We need to handle the special case where MAXLEN is 0. Use the
109 overflow buffer right from the start. */
110 if (maxlen == 0)
112 string = sf.overflow_buf;
113 maxlen = sizeof (sf.overflow_buf);
116 _IO_no_init (&sf.f._sbf._f, _IO_USER_LOCK, -1, NULL, NULL);
117 _IO_JUMPS (&sf.f._sbf) = &_IO_strn_jumps;
118 string[0] = '\0';
119 _IO_str_init_static_internal (&sf.f, string, maxlen - 1, string);
120 ret = INTUSE(_IO_vfprintf) (&sf.f._sbf._f, format, args);
122 if (sf.f._sbf._f._IO_buf_base != sf.overflow_buf)
123 *sf.f._sbf._f._IO_write_ptr = '\0';
124 return ret;
126 ldbl_weak_alias (_IO_vsnprintf, __vsnprintf)
127 ldbl_weak_alias (_IO_vsnprintf, vsnprintf)