Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The GB18030 locale is broken #1971

Open
bhaible opened this issue Dec 15, 2023 · 1 comment
Open

The GB18030 locale is broken #1971

bhaible opened this issue Dec 15, 2023 · 1 comment

Comments

@bhaible
Copy link

bhaible commented Dec 15, 2023

The gnulib unit test tests/test-wcrtomb.sh fails on CheriBSD, while it succeeds on FreeBSD 14.0.

$ LC_ALL=zh_CN.GB18030 ./test-wcrtomb 5
In-address space security exception (core dumped)

In gdb, I get this stack trace:

(gdb) where
#0  strlen (str=0xfffffff7fcfc [rwRW,0xfffffff7fcfc-0xfffffff7fcfd] "\t")
    at /local/scratch/jenkins/workspace/CheriBSD-pipeline_releng_22.12@2/cheribsd/lib/libc/string/strlen.c:146
#1  0x0000000040268790 in _GB18030_mbrtowc (
    pwc=0xfffffff7fcf8 [rwRW,0xfffffff7fcf8-0xfffffff7fcfc] L"", 
    s=0xfffffff7fcfc [rwRW,0xfffffff7fcfc-0xfffffff7fcfd] "\t", n=1, 
    ps=0xfffffff7fd00 [rwRW,0xfffffff7fd00-0xfffffff7fd80])
    at /local/scratch/jenkins/workspace/CheriBSD-pipeline_releng_22.12@2/cheribsd/lib/libc/locale/gb18030.c:127
#2  0x00000000402670a4 in btowc_l (l=<optimized out>, c=<optimized out>)
    at /local/scratch/jenkins/workspace/CheriBSD-pipeline_releng_22.12@2/cheribsd/lib/libc/locale/btowc.c:58
#3  btowc (c=<optimized out>)
    at /local/scratch/jenkins/workspace/CheriBSD-pipeline_releng_22.12@2/cheribsd/lib/libc/locale/btowc.c:65
#4  0x0000000000111540 in main (argc=2, 
    argv=0xffffbff7f620 [rwRW,0xffffbff7f620-0xffffbff7f650])
    at ../../gltests/test-wcrtomb.c:101

In lib/libc/locale/gb18030.c line 125 or 127, it is wrong to call strlen(s), because s cannot be assumed to be NUL-terminated here. The function must only access s[0], ..., s[n-1] and must not make any assumptions about these n bytes.

This bug was introduced in 92bb865 .

@jrtc27
Copy link
Member

jrtc27 commented Dec 15, 2023

Thanks for the report. @trasz do you know what you were trying to achieve back in 2018 with that commit?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants