[committed] libstdc++: Fix out-of-bounds read in format string "{:{}." [PR110974]
Checks
Commit Message
Tested x86_64-linux. Pushed to trunk. Backport to gcc-13 to follow.
-- >8 --
libstdc++-v3/ChangeLog:
PR libstdc++/110974
* include/std/format (_Spec::_S_parse_width_or_precision): Check
for empty range before dereferencing iterator.
* testsuite/std/format/string.cc: Check for expected exception.
Fix expected exception message in test_pr110862() and actually
call it.
---
libstdc++-v3/include/std/format | 7 ++++---
libstdc++-v3/testsuite/std/format/string.cc | 21 ++++++++++++++++++++-
2 files changed, 24 insertions(+), 4 deletions(-)
@@ -520,10 +520,11 @@ namespace __format
if (__first[0] != '.')
return __first;
- ++__first;
+ iterator __next = ++__first;
bool __arg_id = false;
- auto __next = _S_parse_width_or_precision(__first, __last, _M_prec,
- __arg_id, __pc);
+ if (__next != __last)
+ __next = _S_parse_width_or_precision(__first, __last, _M_prec,
+ __arg_id, __pc);
if (__next == __first)
__throw_format_error("format error: missing precision after '.' in "
"format string");
@@ -137,7 +137,24 @@ test_pr110862()
VERIFY( false );
} catch (const std::format_error& e) {
std::string_view what = e.what();
- VERIFY( what.find("unmatched left brace") != what.npos );
+ VERIFY( what.find("unmatched '{'") != what.npos );
+ }
+}
+
+void
+test_pr110974()
+{
+ try {
+ // PR libstdc++/110974 out of bounds read on invalid format string "{:{}."
+ std::string_view fmt{"{:{}.0", 5}; // "0" is not part of the format string.
+ (void) std::vformat(fmt, std::make_format_args(1.0, 1));
+ VERIFY( false );
+ } catch (const std::format_error& e) {
+ std::string_view what = e.what();
+ // GCC 13.2 throws "invalid width or precision in format-spec" after
+ // trying to parse the "0" past-the-end of the format string.
+ // There should be an exception before even trying that:
+ VERIFY( what.find("missing precision after '.'") != what.npos );
}
}
@@ -146,4 +163,6 @@ int main()
test_no_args();
test_indexing();
test_format_spec();
+ test_pr110862();
+ test_pr110974();
}