src/lib/libc/stdio/fflush.c, branch releng/12.4

fflush: correct buffer handling in __sflush

2023-11-08T01:01:23Z

This fixes CVE-2014-8611 correctly. The commit that purported to fix CVE-2014-8611 (805288c2f062) only hid it behind another bug. Two later commits, 86a16ada1ea6 and 44cf1e5eb470, attempted to address this new bug but mostly just confused the issue. This commit rolls back the three previous changes and fixes CVE-2014-8611 correctly. The key to understanding the bug (and the fix) is that `_w` has different meanings for different stream modes. If the stream is unbuffered, it is always zero. If the stream is fully buffered, it is the amount of space remaining in the buffer (equal to the buffer size when the buffer is empty and zero when the buffer is full). If the stream is line-buffered, it is a negative number reflecting the amount of data in the buffer (zero when the buffer is empty and negative buffer size when the buffer is full). At the heart of `fflush()`, we call the stream's write function in a loop, where `t` represents the return value from the last call and `n` the amount of data that remains to be written. When the write function fails, we need to move the unwritten data to the top of the buffer (unless nothing was written) and adjust `_p` (which points to the next free location in the buffer) and `_w` accordingly. These variables have already been set to the values they should have after a successful flush, so instead of adjusting them down to reflect what was written, we're adjusting them up to reflect what remains. The bug was that while `_p` was always adjusted, we only adjusted `_w` if the stream was fully buffered. The fix is to also adjust `_w` for line-buffered streams. Everything else is just noise. Fixes: 805288c2f062 Fixes: 86a16ada1ea6 Fixes: 44cf1e5eb470 Sponsored by: Klara, Inc. (cherry picked from commit 1f90b4edffe815aebb35e74b79e10593b31f6b75) (cherry picked from commit 1e99535be2ea9c0ef8bc57fc885e9c01fa95d2dd) (cherry picked from commit ccdd8337f9cbd7d34e2e95df1440dd5f7225d0b4) (cherry picked from commit 95fbce59c9f4ed4015b19a88491a37dac9d4e7d5) (cherry picked from commit d09a3bf72c0b5f1779c52269671872368c99f02a) (cherry picked from commit 92709431b14df6c0687446247ac57cfc189ee827) (cherry picked from commit 6cb5690b3495741e9ece6f42ba4a85732932aa83) (cherry picked from commit 3a2ea31568c81f7b29710abd3d3e1ada2fbeb6c9) Approved by: so Security: SA-23:15.stdio Sponsored by: The FreeBSD Foundation

MFC r357284, r357419: stdio unlocked

2020-02-13T03:13:29Z

r357284: stdio: provide _unlocked variants of fflush, fputc, fputs, fread, fwrite fflush_unlocked is currently desired in ports by sysutils/metalog, and redefined as the locked fflush. fputc_unlocked, fputs_unlocked, fread_unlocked, and fwrite_unlocked are currently desired in ports by devel/elfutils, and redefined as the locked fputs, fread, and fwrite respectively. r357419: libc: provide fputc_unlocked Among the same justification as the other stdio _unlocked; in addition to an inline version in , we must provide a function in libc as well for the functionality. This fixes the lang/gcc* builds, which want to use the symbol from libc.

General further adoption of SPDX licensing ID tags.

2017-11-20T19:49:47Z

Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point.

Make stdio deferred cancel-safe.

2017-06-29T14:44:17Z

If used with fopen(3)/fdopen(3)-ed FILEs, stdio accurately uses non-cancellable internal versions of the functions, i.e. it seems to be fine with regard to cancellation. But if the funopen(3) and f{r,w}open(3) functions were used to open the FILE, and corresponding user functions create cancellation points (they typically have no other choice), then stdio code at least leaks FILE' lock. The change installs cleanup handler which unlocks FILE. Some minimal restructuring of the code was required to make it use common return place to satisfy hand-rolled pthread_cleanup_pop() requirements. Noted by: eugen Reviewed by: eugen, vangyzen Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 2 weeks Differential revision: https://reviews.freebsd.org/D11246

In r268924 __fflush was modified so that when write(2) was not successful,

2014-12-10T08:18:22Z

_p and _w are adjusted to account for the partial write (if any). However, _p and _w should not be unconditionally adjusted and should only be changed when we actually wrote some bytes, or the accumulated accounting error will eventually result in a heap buffer overflow. Reported by: adrian and alfred (Norse Corporation) Security: FreeBSD-SA-14:27.stdio Security: CVE-2014-8611

Update fflush(3) to return success on a read-only stream.

2014-07-20T20:05:39Z

This has small changes to what Apple uses for compliance with SUSv3. The changes cause no secondary effects in the gnulib tests (we pass them). Obtained from: Apple Inc. (Libc 997.90.3 with changes) Reviewed by: bde Phabric: D440

Renumber clauses to reduce diffs to other versions

2013-04-23T13:33:13Z

NetBSD, OpenBSD, and Android's Bionic all number the clauses 1 through 3, so follow suit to make comparison easier. Acked-by: imp@

Per Regents of the University of Calfornia letter, remove advertising

2007-01-09T00:28:16Z

clause. # If I've done so improperly on a file, please let me know.

Add commentary explaining why we return EBADF upon attempts to fflush() a

2004-07-04T20:17:00Z

read-only file. Discussed on: -current

Fix the style of the SCM ID's.

2002-03-22T21:53:29Z

I believe have made all of libc .c's as consistent as possible.