Re: CVS commit: basesrc/lib/libc/locale

[enami tsugutomo <enami%sm.sony.co.jp@localhost>]

Takuya SHIOZAKI <tshiozak%netbsd.org@localhost> writes:

> Module Name:  basesrc
> Committed By: tshiozak
> Date:         Fri Aug  2 07:12:52 UTC 2002
> 
> Modified Files:
>       basesrc/lib/libc/locale: setlocale.c
> 
> Log Message:
> fix a bug of setlocale when changing locales with LC_ALL for the first
> argunemt and with a string containing many slashes for the second argument.
> This bug may cause setlocale() to destroy static datas.

>From reading the source, there may be still/more bugs.

1) If the first category is followed by multiple slash, it may be
   copied into new_categories[1].  I guess further load may fail tho.

2) If multiple slash appears later, the `locale' may goes beyond the
   `r', and `len' become negative.

I've confirmed the latter actually.

enami.

Index: setlocale.c
===================================================================
RCS file: /cvsroot/basesrc/lib/libc/locale/setlocale.c,v
retrieving revision 1.41
diff -c -r1.41 setlocale.c
*** setlocale.c 2002/08/03 06:12:30     1.41
--- setlocale.c 2002/08/06 07:48:13
***************
*** 153,188 ****
                (void)strlcpy(new_categories[category], locale,
                    sizeof(new_categories[category]));
        } else {
!               if ((r = strchr(locale, '/')) == 0) {
!                       for (i = 1; i < _LC_LAST; ++i) {
!                               (void)strlcpy(new_categories[i], locale,
!                                   sizeof(new_categories[i]));
                        }
!               } else {
!                       for (i = 1; r[1] == '/'; ++r)
!                               ;
!                       if (!r[1])
!                               return (NULL);  /* Hmm, just slashes... */
!                       do {
!                               if (i == _LC_LAST)
!                                       return (NULL);  /* too many slashes. */
!                               len = r - locale;
!                               if (len + 1 > sizeof(new_categories[i]))
!                                       return (NULL);  /* too long */
!                               (void)memcpy(new_categories[i], locale, len);
!                               new_categories[i][len] = '\0';
!                               i++;
!                               locale = r;
!                               while (*locale == '/')
!                                       ++locale;
!                               while (*++r && *r != '/');
!                       } while (*locale);
!                       while (i < _LC_LAST) {
!                               (void)strlcpy(new_categories[i],
!                                   new_categories[i - 1],
!                                   sizeof(new_categories[i]));
!                               i++;
!                       }
                }
        }
  
--- 153,180 ----
                (void)strlcpy(new_categories[category], locale,
                    sizeof(new_categories[category]));
        } else {
!               for (i = 1;; i++, locale = r) {
!                       while (*locale == '/')
!                               locale++;
!                       for (r = locale; *r && *r != '/';)
!                               r++;
!                       len = r - locale;
!                       if (len == 0) {
!                               if (i == 1)
!                                       return (NULL); /* Hmm, just
!                                                         slashes... */
!                               break;          /* The end of string */
                        }
!                       if (len + 1 > sizeof(new_categories[i]))
!                               return (NULL);  /* too long */
!                       (void)memcpy(new_categories[i], locale, len);
!                       new_categories[i][len] = '\0';
!               }
!               while (i < _LC_LAST) {
!                       (void)strlcpy(new_categories[i],
!                           new_categories[i - 1],
!                           sizeof(new_categories[i]));
!                       i++;
                }
        }