From sos22@cam.ac.uk  Wed Apr 21 01:17:44 2004
Return-Path: <sos22@cam.ac.uk>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2619F16A4CE
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 21 Apr 2004 01:17:44 -0700 (PDT)
Received: from yellow.csi.cam.ac.uk (yellow.csi.cam.ac.uk [131.111.8.67])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B052543D2D
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 21 Apr 2004 01:17:43 -0700 (PDT)
	(envelope-from sos22@cam.ac.uk)
Received: from archibold.chu.cam.ac.uk ([131.111.131.102])
	by yellow.csi.cam.ac.uk with smtp (Exim 4.12)
	id 1BGCvO-0003ku-00
	for FreeBSD-gnats-submit@freebsd.org; Wed, 21 Apr 2004 09:17:42 +0100
Received: by archibold.chu.cam.ac.uk (sSMTP sendmail emulation); Wed, _d Apr 2004 09:18:00 +0100
Message-Id: <E1BGCvO-0003ku-00@yellow.csi.cam.ac.uk>
Date: Wed, _d Apr 2004 09:18:00 +0100
From: "Steven Smith" <sos22@cam.ac.uk>
Reply-To: Steven Smith <sos22-fbsd@srcf.ucam.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [patch] vfprintf on CURRENT produces odd results when used with many arguments
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         65841
>Category:       misc
>Synopsis:       [patch] vfprintf on CURRENT produces odd results when used with many arguments
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    tjr
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 21 01:20:21 PDT 2004
>Closed-Date:    Thu Apr 22 04:36:25 PDT 2004
>Last-Modified:  Thu Apr 22 04:36:25 PDT 2004
>Originator:     Steven Smith
>Release:        FreeBSD 5.2-CURRENT i386
>Organization:
>Environment:
System: FreeBSD archibold.chu.cam.ac.uk 5.2-CURRENT FreeBSD 5.2-CURRENT #14: Mon Apr 19 17:59:53 BST 2004 sos22@archibold.chu.cam.ac.uk:/usr/src/sys/i386/compile/ARCHYKERNEL i386


>Description:
	__grow_type_table in src/lib/libc/stdio/vfprintf.c treats tablesize
	as a byte count, whereas the rest of the code treats it as a
	count of the elements in an array.  This causes problems if a
	large number of arguments are used in a printf format and some
	``%5$d''-style escapes are used to refer to arguments by index.

>How-To-Repeat:
	The attached program test.c produces output
	``1 -791621424 -791621424 -791621424 -791621424 -791621424 -791621424 2''

>Fix:
	The attached patch printf.diff seems to fix the problem.  Patch is
	against CVS version 1.63.

--- test.c begins here ---
#include <stdio.h>

int
main()
{
	printf("%1$d %2$d %3$d %4$d %5$d %6$d %7$d %8$d\n",
	       1,2,3,4,5,6,7,8);
	return 0;
}
--- test.c ends here ---

--- printf.diff begins here ---
Index: lib/libc/stdio/vfprintf.c
===================================================================
RCS file: /home/ncvs/src/lib/libc/stdio/vfprintf.c,v
retrieving revision 1.63
diff -u -w -r1.63 vfprintf.c
--- lib/libc/stdio/vfprintf.c	7 Apr 2004 09:55:05 -0000	1.63
+++ lib/libc/stdio/vfprintf.c	21 Apr 2004 07:47:41 -0000
@@ -1595,14 +1595,15 @@
 	if (newsize < nextarg + 1)
 		newsize = nextarg + 1;
 	if (oldsize == STATIC_ARG_TBL_SIZE) {
-		if ((newtable = malloc(newsize)) == NULL)
+		if ((newtable = malloc(newsize * sizeof(enum typeid))) == NULL)
 			abort();			/* XXX handle better */
-		bcopy(oldtable, newtable, oldsize);
+		bcopy(oldtable, newtable, oldsize * sizeof(enum typeid));
 	} else {
-		if ((newtable = reallocf(oldtable, newsize)) == NULL)
+		newtable = reallocf(oldtable, newsize * sizeof(enum typeid));
+		if (newtable == NULL)
 			abort();			/* XXX handle better */
 	}
-	memset(&newtable[oldsize], T_UNUSED, newsize - oldsize);
+	memset(&newtable[oldsize], T_UNUSED, (newsize - oldsize) * sizeof(enum typeid));
 
 	*typetable = newtable;
 	*tablesize = newsize;
--- printf.diff ends here ---


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->tjr 
Responsible-Changed-By: tjr 
Responsible-Changed-When: Wed Apr 21 02:13:43 PDT 2004 
Responsible-Changed-Why:  
I'll take a look at this. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=65841 
State-Changed-From-To: open->closed 
State-Changed-By: tjr 
State-Changed-When: Thu Apr 22 04:36:03 PDT 2004 
State-Changed-Why:  
Fixed in -current, thanks. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=65841 
>Unformatted:
