src/lib/libc/stdio, branch releng/12.4

fflush: correct buffer handling in __sflush

2023-11-08T01:01:23Z

This fixes CVE-2014-8611 correctly. The commit that purported to fix CVE-2014-8611 (805288c2f062) only hid it behind another bug. Two later commits, 86a16ada1ea6 and 44cf1e5eb470, attempted to address this new bug but mostly just confused the issue. This commit rolls back the three previous changes and fixes CVE-2014-8611 correctly. The key to understanding the bug (and the fix) is that `_w` has different meanings for different stream modes. If the stream is unbuffered, it is always zero. If the stream is fully buffered, it is the amount of space remaining in the buffer (equal to the buffer size when the buffer is empty and zero when the buffer is full). If the stream is line-buffered, it is a negative number reflecting the amount of data in the buffer (zero when the buffer is empty and negative buffer size when the buffer is full). At the heart of `fflush()`, we call the stream's write function in a loop, where `t` represents the return value from the last call and `n` the amount of data that remains to be written. When the write function fails, we need to move the unwritten data to the top of the buffer (unless nothing was written) and adjust `_p` (which points to the next free location in the buffer) and `_w` accordingly. These variables have already been set to the values they should have after a successful flush, so instead of adjusting them down to reflect what was written, we're adjusting them up to reflect what remains. The bug was that while `_p` was always adjusted, we only adjusted `_w` if the stream was fully buffered. The fix is to also adjust `_w` for line-buffered streams. Everything else is just noise. Fixes: 805288c2f062 Fixes: 86a16ada1ea6 Fixes: 44cf1e5eb470 Sponsored by: Klara, Inc. (cherry picked from commit 1f90b4edffe815aebb35e74b79e10593b31f6b75) (cherry picked from commit 1e99535be2ea9c0ef8bc57fc885e9c01fa95d2dd) (cherry picked from commit ccdd8337f9cbd7d34e2e95df1440dd5f7225d0b4) (cherry picked from commit 95fbce59c9f4ed4015b19a88491a37dac9d4e7d5) (cherry picked from commit d09a3bf72c0b5f1779c52269671872368c99f02a) (cherry picked from commit 92709431b14df6c0687446247ac57cfc189ee827) (cherry picked from commit 6cb5690b3495741e9ece6f42ba4a85732932aa83) (cherry picked from commit 3a2ea31568c81f7b29710abd3d3e1ada2fbeb6c9) Approved by: so Security: SA-23:15.stdio Sponsored by: The FreeBSD Foundation

libc: Fix size range check in setvbuf

2022-10-07T15:23:27Z

From enh at google.com via openbsd-tech mailing list via pfg@: The existing test is wrong for LP64, where size_t has twice as many relevant bits as int, not just one. (Found by inspection by rprichard.) (cherry picked from commit 9515313b26beb005a521aff2e6edd4d75cd010da)

MFC r364029: tmpnam(3): Also mention tmpfile in the ENVIRONMENT section

2020-08-14T06:48:29Z

PR: 181785 Submitted by: Kevin P. Neal

MFC r359547, r359629 (by imp): Note some functions that appeared in First Edition Unix

2020-08-01T14:22:05Z

These functions first appeared in the First Edition of Unix (or earlier in the pdp-7 version). Just claim 1st Edition for all this. The pdp-7 code is too fragmented at this point to extend history that far back.

MFC r359773 (by carlavilla): Add HISTORY section to getc(3)

2020-08-01T14:08:05Z

PR: 240269 Submitted by: gbe Reviewed by: imp Differential Revision: https://reviews.freebsd.org/D24295

MFC r362326: fgetln(3): Add a Caveats Section

2020-06-27T13:55:38Z

Reviewed by: yuripv, bcr (mentor) Approved by: bcr (mentror) Obtained from: OpenBSD Differential Revision: https://reviews.freebsd.org/D24916

MFC r362171: libc manpages: various improvements from NetBSD

2020-06-27T12:12:47Z

- Add STANDARDS and HISTORY sections within the appropriate manpages - Mention two USENIX papers within kqueue(2) and strlcpy(3) Reviewed by: bcr (mentor) Approved by: bcr (mentor) Obtained from: NetBSD Differential Revision: https://reviews.freebsd.org/D24650

MFC r357284, r357419: stdio unlocked

2020-02-13T03:13:29Z

r357284: stdio: provide _unlocked variants of fflush, fputc, fputs, fread, fwrite fflush_unlocked is currently desired in ports by sysutils/metalog, and redefined as the locked fflush. fputc_unlocked, fputs_unlocked, fread_unlocked, and fwrite_unlocked are currently desired in ports by devel/elfutils, and redefined as the locked fputs, fread, and fwrite respectively. r357419: libc: provide fputc_unlocked Among the same justification as the other stdio _unlocked; in addition to an inline version in , we must provide a function in libc as well for the functionality. This fixes the lang/gcc* builds, which want to use the symbol from libc.

MFC r339883:

2018-11-17T19:58:34Z

Expose some netdump configuration parameters through sysctl.

Follow up on r331936. gets_s(3) will also fail in the same way that

2018-10-28T00:57:39Z

gets(3) does. This was missed in r331936. Reported by: emaste@ Approved by: re (kib@)