Print this page
10468 __ctype_mask[EOF] has been working by accident
10469 GCC's -faggressive-loop-optimizations is too aggressive
10470 array over-read in has_saved_fp()
Reviewed by: Robert Mustacchi <rm@joyent.com>
Reviewed by: John Levon <john.levon@joyent.com>

Split Close
Expand all
Collapse all
          --- old/usr/src/lib/libc/port/locale/table.c
          +++ new/usr/src/lib/libc/port/locale/table.c
   1    1  /*
   2    2   * Copyright 2013 Garrett D'Amore <garrett@damore.org>
   3    3   * Copyright 2017 Nexenta Systems, Inc.
        4 + * Copyright 2019 Joyent, Inc.
   4    5   * Copyright (c) 1993
   5    6   *      The Regents of the University of California.  All rights reserved.
   6    7   *
   7    8   * This code is derived from software contributed to Berkeley by
   8    9   * Paul Borman at Krystal Technologies.
   9   10   *
  10   11   * Redistribution and use in source and binary forms, with or without
  11   12   * modification, are permitted provided that the following conditions
  12   13   * are met:
  13   14   * 1. Redistributions of source code must retain the above copyright
↓ open down ↓ 18 lines elided ↑ open up ↑
  32   33   * SUCH DAMAGE.
  33   34   */
  34   35  
  35   36  #include "lint.h"
  36   37  #include <ctype.h>
  37   38  #include <wchar.h>
  38   39  #include "runetype.h"
  39   40  #include "mblocal.h"
  40   41  #include "_ctype.h"
  41   42  
  42      -#define _DEFRUNETYPE { \
       43 +#define _DEFRUNETYPE \
  43   44          /* 00 */ \
  44   45          _CTYPE_C, \
  45   46          _CTYPE_C, \
  46   47          _CTYPE_C, \
  47   48          _CTYPE_C, \
  48   49          _CTYPE_C, \
  49   50          _CTYPE_C, \
  50   51          _CTYPE_C, \
  51   52          _CTYPE_C, \
  52   53          /* 08 */ \
↓ open down ↓ 123 lines elided ↑ open up ↑
 176  177          _CTYPE_L|_CTYPE_R|_CTYPE_G|_CTYPE_A, \
 177  178          _CTYPE_L|_CTYPE_R|_CTYPE_G|_CTYPE_A, \
 178  179          /* 78 */ \
 179  180          _CTYPE_L|_CTYPE_R|_CTYPE_G|_CTYPE_A, \
 180  181          _CTYPE_L|_CTYPE_R|_CTYPE_G|_CTYPE_A, \
 181  182          _CTYPE_L|_CTYPE_R|_CTYPE_G|_CTYPE_A, \
 182  183          _CTYPE_P|_CTYPE_R|_CTYPE_G, \
 183  184          _CTYPE_P|_CTYPE_R|_CTYPE_G, \
 184  185          _CTYPE_P|_CTYPE_R|_CTYPE_G, \
 185  186          _CTYPE_P|_CTYPE_R|_CTYPE_G, \
 186      -        _CTYPE_C, \
 187      -}
      187 +        _CTYPE_C
 188  188  
 189      -#define _DEFMAPLOWER { \
      189 +#define _DEFMAPLOWER \
 190  190          0x00,   0x01,   0x02,   0x03,   0x04,   0x05,   0x06,   0x07, \
 191  191          0x08,   0x09,   0x0a,   0x0b,   0x0c,   0x0d,   0x0e,   0x0f, \
 192  192          0x10,   0x11,   0x12,   0x13,   0x14,   0x15,   0x16,   0x17, \
 193  193          0x18,   0x19,   0x1a,   0x1b,   0x1c,   0x1d,   0x1e,   0x1f, \
 194  194          0x20,   0x21,   0x22,   0x23,   0x24,   0x25,   0x26,   0x27, \
 195  195          0x28,   0x29,   0x2a,   0x2b,   0x2c,   0x2d,   0x2e,   0x2f, \
 196  196          0x30,   0x31,   0x32,   0x33,   0x34,   0x35,   0x36,   0x37, \
 197  197          0x38,   0x39,   0x3a,   0x3b,   0x3c,   0x3d,   0x3e,   0x3f, \
 198  198          0x40,   'a',    'b',    'c',    'd',    'e',    'f',    'g', \
 199  199          'h',    'i',    'j',    'k',    'l',    'm',    'n',    'o', \
↓ open down ↓ 11 lines elided ↑ open up ↑
 211  211          0xa8,   0xa9,   0xaa,   0xab,   0xac,   0xad,   0xae,   0xaf, \
 212  212          0xb0,   0xb1,   0xb2,   0xb3,   0xb4,   0xb5,   0xb6,   0xb7, \
 213  213          0xb8,   0xb9,   0xba,   0xbb,   0xbc,   0xbd,   0xbe,   0xbf, \
 214  214          0xc0,   0xc1,   0xc2,   0xc3,   0xc4,   0xc5,   0xc6,   0xc7, \
 215  215          0xc8,   0xc9,   0xca,   0xcb,   0xcc,   0xcd,   0xce,   0xcf, \
 216  216          0xd0,   0xd1,   0xd2,   0xd3,   0xd4,   0xd5,   0xd6,   0xd7, \
 217  217          0xd8,   0xd9,   0xda,   0xdb,   0xdc,   0xdd,   0xde,   0xdf, \
 218  218          0xe0,   0xe1,   0xe2,   0xe3,   0xe4,   0xe5,   0xe6,   0xe7, \
 219  219          0xe8,   0xe9,   0xea,   0xeb,   0xec,   0xed,   0xee,   0xef, \
 220  220          0xf0,   0xf1,   0xf2,   0xf3,   0xf4,   0xf5,   0xf6,   0xf7, \
 221      -        0xf8,   0xf9,   0xfa,   0xfb,   0xfc,   0xfd,   0xfe,   0xff, \
 222      -}
      221 +        0xf8,   0xf9,   0xfa,   0xfb,   0xfc,   0xfd,   0xfe,   0xff
 223  222  
 224      -#define _DEFMAPUPPER { \
      223 +#define _DEFMAPUPPER \
 225  224          0x00,   0x01,   0x02,   0x03,   0x04,   0x05,   0x06,   0x07, \
 226  225          0x08,   0x09,   0x0a,   0x0b,   0x0c,   0x0d,   0x0e,   0x0f, \
 227  226          0x10,   0x11,   0x12,   0x13,   0x14,   0x15,   0x16,   0x17, \
 228  227          0x18,   0x19,   0x1a,   0x1b,   0x1c,   0x1d,   0x1e,   0x1f, \
 229  228          0x20,   0x21,   0x22,   0x23,   0x24,   0x25,   0x26,   0x27, \
 230  229          0x28,   0x29,   0x2a,   0x2b,   0x2c,   0x2d,   0x2e,   0x2f, \
 231  230          0x30,   0x31,   0x32,   0x33,   0x34,   0x35,   0x36,   0x37, \
 232  231          0x38,   0x39,   0x3a,   0x3b,   0x3c,   0x3d,   0x3e,   0x3f, \
 233  232          0x40,   'A',    'B',    'C',    'D',    'E',    'F',    'G', \
 234  233          'H',    'I',    'J',    'K',    'L',    'M',    'N',    'O', \
↓ open down ↓ 11 lines elided ↑ open up ↑
 246  245          0xa8,   0xa9,   0xaa,   0xab,   0xac,   0xad,   0xae,   0xaf, \
 247  246          0xb0,   0xb1,   0xb2,   0xb3,   0xb4,   0xb5,   0xb6,   0xb7, \
 248  247          0xb8,   0xb9,   0xba,   0xbb,   0xbc,   0xbd,   0xbe,   0xbf, \
 249  248          0xc0,   0xc1,   0xc2,   0xc3,   0xc4,   0xc5,   0xc6,   0xc7, \
 250  249          0xc8,   0xc9,   0xca,   0xcb,   0xcc,   0xcd,   0xce,   0xcf, \
 251  250          0xd0,   0xd1,   0xd2,   0xd3,   0xd4,   0xd5,   0xd6,   0xd7, \
 252  251          0xd8,   0xd9,   0xda,   0xdb,   0xdc,   0xdd,   0xde,   0xdf, \
 253  252          0xe0,   0xe1,   0xe2,   0xe3,   0xe4,   0xe5,   0xe6,   0xe7, \
 254  253          0xe8,   0xe9,   0xea,   0xeb,   0xec,   0xed,   0xee,   0xef, \
 255  254          0xf0,   0xf1,   0xf2,   0xf3,   0xf4,   0xf5,   0xf6,   0xf7, \
 256      -        0xf8,   0xf9,   0xfa,   0xfb,   0xfc,   0xfd,   0xfe,   0xff, \
 257      -}
      255 +        0xf8,   0xf9,   0xfa,   0xfb,   0xfc,   0xfd,   0xfe,   0xff,
 258  256  
 259  257  _RuneLocale _DefaultRuneLocale = {
 260  258          _RUNE_MAGIC_1,
 261  259          "NONE",
 262      -        _DEFRUNETYPE,
 263      -        _DEFMAPLOWER,
 264      -        _DEFMAPUPPER,
      260 +        { _DEFRUNETYPE },
      261 +        { _DEFMAPLOWER },
      262 +        { _DEFMAPUPPER },
 265  263  };
 266  264  
 267  265  /*
 268  266   * __ctype_mask, __trans_lower, and __trans_upper come from former _ctype.c and
 269  267   * have to stay pointers for binary compatibility, so we provide separate
 270      - * storage for them, initialized to "C" locale contents by default.
      268 + * storage for them, initialized to "C" locale contents by default.  Note that
      269 + * legacy code may dereference __ctype_mask[-1] when checking against EOF,
      270 + * relying on that value to be 0.  To allow this, ___ctype_mask is expanded by
      271 + * one value and prepended with a leading 0, with __ctype_mask being set to
      272 + * point to ___ctype_mask[1].  (__trans_lower and __trans_upper do not suffer
      273 + * from this as EOF access was prevented in legacy code by a check against
      274 + * isascii(), which always returned 0 for EOF.)
 271  275   */
 272      -static unsigned int ___ctype_mask[_CACHED_RUNES] = _DEFRUNETYPE;
 273      -unsigned int *__ctype_mask = ___ctype_mask;
      276 +static unsigned int ___ctype_mask[_CACHED_RUNES + 1] = { 0, _DEFRUNETYPE };
      277 +unsigned int *__ctype_mask = &___ctype_mask[1];
 274  278  
 275      -static int ___trans_lower[_CACHED_RUNES] = _DEFMAPLOWER;
      279 +static int ___trans_lower[_CACHED_RUNES] = { _DEFMAPLOWER };
 276  280  int *__trans_lower = ___trans_lower;
 277  281  
 278      -static int ___trans_upper[_CACHED_RUNES] = _DEFMAPUPPER;
      282 +static int ___trans_upper[_CACHED_RUNES] = { _DEFMAPUPPER };
 279  283  int *__trans_upper = ___trans_upper;
    
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX