Configuration Information:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS: -g -O2
uname output: Linux penguin.cs.ucla.edu 6.7.7-200.fc39.x86_64 #1 SMP
PREEMPT_DYNAMIC Fri Mar 1 16:53:59 UTC 2024 x86_64 GNU/Linux
Machine Type: x86_64-redhat-linux-gnu
Bash Version: 5.3
Patch Level: 26
Release Status: devel
Description:
Commands like "printf '%10000000000000000000000000000s' ''"
silently ignore width and precision. They should report the
integer overflow before continuing with a lesser width or
precision. (I ran into this bug while using Bash to output
very long strings of spaces for some test cases.)
Repeat-By:
printf '%10000000000000000000000000000s' ''
It prints nothing. It should print a diagnostic if it
cannot do the requested operation.
Fix:
Bash should use C23 <stdckdint.h> to check for integer
overflow. Gnulib supplies a replacement stdckdint.h that works
on pre-C23 platforms; it's been extensively tested in other GNU
apps and doesn't require much setup.
The attached patches first add <stdckdint.h> to Bash, then
replace Bash's by-hand overflow checking (which I think I
contributed a while ago, if memory serves) with uses of the
standard C23 macros, and finally fixes printf. Although there
are several other integer overflow bugs in Bash I thought
I'd send these fixes in now.
These patches use the Gnulib files intprops-internal.h and
stdckdint.in.h unmodified. I thought this would be better
than trying to simplify them to cover just Bash's needs, as
it will make it easier to sync with Gnulib later. However,
for simplicity these patches do not use all the Gnulib machinery
for <stdckdint.h>.
These patches can be applied to Bash's devel branch (commit
54f3ed2278025081f897b9bd958fcf099fd5be18 dated Mon Mar 4
14:59:33 2024 -0500) by using the command "git am".From 1f961bac5445929dc86ca8814b94548b16034337 Mon Sep 17 00:00:00 2001
From: Paul Eggert <egg...@cs.ucla.edu>
Date: Fri, 8 Mar 2024 21:58:46 -0800
Subject: [PATCH 1/4] maint: add support for C23-style stdckdint.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This is so that Bash can do proper checking for internal
integer overflow. This change doesn't change Bash proper;
it only adds the minimum changes needed so that
C23-style "#include <stdckdint.h>" will work portably
to older systems.
* Makefile.in (CREATED_CONFIGURE): Add stdckdint.h.
* configure.ac: Check for stdckdint.h. If it works, remove
any stdckdint.h left over from a previous ‘configure’;
otherwise, create one.
* .gitignore: Add stdckdint.h.
* include/stdckdint.in.h, include/intprops-internal.h:
New files, copied verbatim from Gnulib.
---
.gitignore | 1 +
Makefile.in | 1 +
configure.ac | 7 +
include/intprops-internal.h | 397 ++++++++++++++++++++++++++++++++++++
include/stdckdint.in.h | 35 ++++
5 files changed, 441 insertions(+)
create mode 100644 include/intprops-internal.h
create mode 100644 include/stdckdint.in.h
diff --git a/.gitignore b/.gitignore
index 2c10177c..15b219d3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -70,6 +70,7 @@ support/bashbug.sh
lsignames.h
pathnames.h
signames.h
+stdckdint.h
version.h
syntax.c
stamp-h
diff --git a/Makefile.in b/Makefile.in
index 41443c6d..2b4b713c 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -584,6 +584,7 @@ CREATED_SUPPORT = signames.h recho$(EXEEXT) zecho$(EXEEXT) printenv$(EXEEXT) \
mksyntax${EXEEXT} syntax.c $(VERSPROG) $(VERSOBJ) \
buildversion.o mksignames.o signames.o buildsignames.o
CREATED_CONFIGURE = config.h config.cache config.status config.log \
+ stdckdint.h \
stamp-h po/POTFILES config.status.lineno
CREATED_MAKEFILES = Makefile builtins/Makefile doc/Makefile \
lib/readline/Makefile lib/glob/Makefile \
diff --git a/configure.ac b/configure.ac
index d4ca74e5..7befb6c2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -787,6 +787,7 @@ BASH_HEADER_INTTYPES
AC_CHECK_HEADERS(unistd.h stdlib.h varargs.h limits.h string.h \
memory.h locale.h termcap.h termio.h termios.h dlfcn.h \
+ stdckdint.h \
stdbool.h stddef.h stdint.h netdb.h pwd.h grp.h strings.h \
regex.h syslog.h ulimit.h)
AC_CHECK_HEADERS(sys/pte.h sys/stream.h sys/select.h sys/file.h sys/ioctl.h \
@@ -1352,4 +1353,10 @@ AC_CONFIG_FILES([Makefile builtins/Makefile lib/readline/Makefile \
dnl Makefile uses this timestamp file to record whether config.h is up to date.
AC_CONFIG_COMMANDS([stamp-h], [echo timestamp > stamp-h])
+if test "$ac_cv_header_stdckdint_h" = yes; then
+ rm -f stdckdint.h
+else
+ echo '#include <stdckdint.in.h>' >stdckdint.h
+fi
+
AC_OUTPUT
diff --git a/include/intprops-internal.h b/include/intprops-internal.h
new file mode 100644
index 00000000..c8a87d2b
--- /dev/null
+++ b/include/intprops-internal.h
@@ -0,0 +1,397 @@
+/* intprops-internal.h -- properties of integer types not visible to users
+
+ Copyright (C) 2001-2024 Free Software Foundation, Inc.
+
+ This program is free software: you can redistribute it and/or modify it
+ under the terms of the GNU Lesser General Public License as published
+ by the Free Software Foundation; either version 2.1 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>. */
+
+#ifndef _GL_INTPROPS_INTERNAL_H
+#define _GL_INTPROPS_INTERNAL_H
+
+#include <limits.h>
+
+/* Pacify GCC 13.2 in some calls to _GL_EXPR_SIGNED. */
+#if defined __GNUC__ && 4 < __GNUC__ + (3 <= __GNUC_MINOR__)
+# pragma GCC diagnostic ignored "-Wtype-limits"
+#endif
+
+/* Return a value with the common real type of E and V and the value of V.
+ Do not evaluate E. */
+#define _GL_INT_CONVERT(e, v) ((1 ? 0 : (e)) + (v))
+
+/* Act like _GL_INT_CONVERT (E, -V) but work around a bug in IRIX 6.5 cc; see
+ <https://lists.gnu.org/r/bug-gnulib/2011-05/msg00406.html>. */
+#define _GL_INT_NEGATE_CONVERT(e, v) ((1 ? 0 : (e)) - (v))
+
+/* The extra casts in the following macros work around compiler bugs,
+ e.g., in Cray C 5.0.3.0. */
+
+/* True if the real type T is signed. */
+#define _GL_TYPE_SIGNED(t) (! ((t) 0 < (t) -1))
+
+/* Return 1 if the real expression E, after promotion, has a
+ signed or floating type. Do not evaluate E. */
+#define _GL_EXPR_SIGNED(e) (_GL_INT_NEGATE_CONVERT (e, 1) < 0)
+
+
+/* Minimum and maximum values for integer types and expressions. */
+
+/* The width in bits of the integer type or expression T.
+ Do not evaluate T. T must not be a bit-field expression.
+ Padding bits are not supported; this is checked at compile-time below. */
+#define _GL_TYPE_WIDTH(t) (sizeof (t) * CHAR_BIT)
+
+/* The maximum and minimum values for the type of the expression E,
+ after integer promotion. E is not evaluated. */
+#define _GL_INT_MINIMUM(e) \
+ (_GL_EXPR_SIGNED (e) \
+ ? ~ _GL_SIGNED_INT_MAXIMUM (e) \
+ : _GL_INT_CONVERT (e, 0))
+#define _GL_INT_MAXIMUM(e) \
+ (_GL_EXPR_SIGNED (e) \
+ ? _GL_SIGNED_INT_MAXIMUM (e) \
+ : _GL_INT_NEGATE_CONVERT (e, 1))
+#define _GL_SIGNED_INT_MAXIMUM(e) \
+ (((_GL_INT_CONVERT (e, 1) << (_GL_TYPE_WIDTH (+ (e)) - 2)) - 1) * 2 + 1)
+
+/* Work around OpenVMS incompatibility with C99. */
+#if !defined LLONG_MAX && defined __INT64_MAX
+# define LLONG_MAX __INT64_MAX
+# define LLONG_MIN __INT64_MIN
+#endif
+
+/* This include file assumes that signed types are two's complement without
+ padding bits; the above macros have undefined behavior otherwise.
+ If this is a problem for you, please let us know how to fix it for your host.
+ This assumption is tested by the intprops-tests module. */
+
+/* Does the __typeof__ keyword work? This could be done by
+ 'configure', but for now it's easier to do it by hand. */
+#if (2 <= __GNUC__ \
+ || (4 <= __clang_major__) \
+ || (1210 <= __IBMC__ && defined __IBM__TYPEOF__) \
+ || (0x5110 <= __SUNPRO_C && !__STDC__))
+# define _GL_HAVE___TYPEOF__ 1
+#else
+# define _GL_HAVE___TYPEOF__ 0
+#endif
+
+/* Return 1 if the integer type or expression T might be signed. Return 0
+ if it is definitely unsigned. T must not be a bit-field expression.
+ This macro does not evaluate its argument, and expands to an
+ integer constant expression. */
+#if _GL_HAVE___TYPEOF__
+# define _GL_SIGNED_TYPE_OR_EXPR(t) _GL_TYPE_SIGNED (__typeof__ (t))
+#else
+# define _GL_SIGNED_TYPE_OR_EXPR(t) 1
+#endif
+
+/* Return 1 if - A would overflow in [MIN,MAX] arithmetic.
+ A should not have side effects, and A's type should be an
+ integer with minimum value MIN and maximum MAX. */
+#define _GL_INT_NEGATE_RANGE_OVERFLOW(a, min, max) \
+ ((min) < 0 ? (a) < - (max) : 0 < (a))
+
+/* True if __builtin_add_overflow (A, B, P) and __builtin_sub_overflow
+ (A, B, P) work when P is non-null. */
+#ifdef __EDG__
+/* EDG-based compilers like nvc 22.1 cannot add 64-bit signed to unsigned
+ <https://bugs.gnu.org/53256>. */
+# define _GL_HAS_BUILTIN_ADD_OVERFLOW 0
+#elif defined __has_builtin
+# define _GL_HAS_BUILTIN_ADD_OVERFLOW __has_builtin (__builtin_add_overflow)
+/* __builtin_{add,sub}_overflow exists but is not reliable in GCC 5.x and 6.x,
+ see <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98269>. */
+#elif 7 <= __GNUC__
+# define _GL_HAS_BUILTIN_ADD_OVERFLOW 1
+#else
+# define _GL_HAS_BUILTIN_ADD_OVERFLOW 0
+#endif
+
+/* True if __builtin_mul_overflow (A, B, P) works when P is non-null. */
+#if defined __clang_major__ && __clang_major__ < 14
+/* Work around Clang bug <https://bugs.llvm.org/show_bug.cgi?id=16404>. */
+# define _GL_HAS_BUILTIN_MUL_OVERFLOW 0
+#else
+# define _GL_HAS_BUILTIN_MUL_OVERFLOW _GL_HAS_BUILTIN_ADD_OVERFLOW
+#endif
+
+/* True if __builtin_add_overflow_p (A, B, C) works, and similarly for
+ __builtin_sub_overflow_p and __builtin_mul_overflow_p. */
+#ifdef __EDG__
+/* In EDG-based compilers like ICC 2021.3 and earlier,
+ __builtin_add_overflow_p etc. are not treated as integral constant
+ expressions even when all arguments are. */
+# define _GL_HAS_BUILTIN_OVERFLOW_P 0
+#elif defined __has_builtin
+# define _GL_HAS_BUILTIN_OVERFLOW_P __has_builtin (__builtin_mul_overflow_p)
+#else
+# define _GL_HAS_BUILTIN_OVERFLOW_P (7 <= __GNUC__)
+#endif
+
+#if (!defined _GL_STDCKDINT_H && 202311 <= __STDC_VERSION__ \
+ && ! (_GL_HAS_BUILTIN_ADD_OVERFLOW && _GL_HAS_BUILTIN_MUL_OVERFLOW))
+# include <stdckdint.h>
+#endif
+
+/* Store the low-order bits of A + B, A - B, A * B, respectively, into *R.
+ Return 1 if the result overflows. Arguments should not have side
+ effects and A, B and *R can be of any integer type other than char,
+ bool, a bit-precise integer type, or an enumeration type. */
+#if _GL_HAS_BUILTIN_ADD_OVERFLOW
+# define _GL_INT_ADD_WRAPV(a, b, r) __builtin_add_overflow (a, b, r)
+# define _GL_INT_SUBTRACT_WRAPV(a, b, r) __builtin_sub_overflow (a, b, r)
+#elif defined ckd_add && defined ckd_sub && !defined _GL_STDCKDINT_H
+# define _GL_INT_ADD_WRAPV(a, b, r) ckd_add (r, + (a), + (b))
+# define _GL_INT_SUBTRACT_WRAPV(a, b, r) ckd_sub (r, + (a), + (b))
+#else
+# define _GL_INT_ADD_WRAPV(a, b, r) \
+ _GL_INT_OP_WRAPV (a, b, r, +, _GL_INT_ADD_RANGE_OVERFLOW)
+# define _GL_INT_SUBTRACT_WRAPV(a, b, r) \
+ _GL_INT_OP_WRAPV (a, b, r, -, _GL_INT_SUBTRACT_RANGE_OVERFLOW)
+#endif
+#if _GL_HAS_BUILTIN_MUL_OVERFLOW
+# if ((9 < __GNUC__ + (3 <= __GNUC_MINOR__) \
+ || (__GNUC__ == 8 && 4 <= __GNUC_MINOR__)) \
+ && !defined __EDG__)
+# define _GL_INT_MULTIPLY_WRAPV(a, b, r) __builtin_mul_overflow (a, b, r)
+# else
+ /* Work around GCC bug 91450. */
+# define _GL_INT_MULTIPLY_WRAPV(a, b, r) \
+ ((!_GL_SIGNED_TYPE_OR_EXPR (*(r)) && _GL_EXPR_SIGNED (a) && _GL_EXPR_SIGNED (b) \
+ && _GL_INT_MULTIPLY_RANGE_OVERFLOW (a, b, 0, (__typeof__ (*(r))) -1)) \
+ ? ((void) __builtin_mul_overflow (a, b, r), 1) \
+ : __builtin_mul_overflow (a, b, r))
+# endif
+#elif defined ckd_mul && !defined _GL_STDCKDINT_H
+# define _GL_INT_MULTIPLY_WRAPV(a, b, r) ckd_mul (r, + (a), + (b))
+#else
+# define _GL_INT_MULTIPLY_WRAPV(a, b, r) \
+ _GL_INT_OP_WRAPV (a, b, r, *, _GL_INT_MULTIPLY_RANGE_OVERFLOW)
+#endif
+
+/* Nonzero if this compiler has GCC bug 68193 or Clang bug 25390. See:
+ https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68193
+ https://llvm.org/bugs/show_bug.cgi?id=25390
+ For now, assume all versions of GCC-like compilers generate bogus
+ warnings for _Generic. This matters only for compilers that
+ lack relevant builtins. */
+#if __GNUC__ || defined __clang__
+# define _GL__GENERIC_BOGUS 1
+#else
+# define _GL__GENERIC_BOGUS 0
+#endif
+
+/* Store the low-order bits of A <op> B into *R, where OP specifies
+ the operation and OVERFLOW the overflow predicate. Return 1 if the
+ result overflows. Arguments should not have side effects,
+ and A, B and *R can be of any integer type other than char, bool, a
+ bit-precise integer type, or an enumeration type. */
+#if 201112 <= __STDC_VERSION__ && !_GL__GENERIC_BOGUS
+# define _GL_INT_OP_WRAPV(a, b, r, op, overflow) \
+ (_Generic \
+ (*(r), \
+ signed char: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, \
+ signed char, SCHAR_MIN, SCHAR_MAX), \
+ unsigned char: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, \
+ unsigned char, 0, UCHAR_MAX), \
+ short int: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, \
+ short int, SHRT_MIN, SHRT_MAX), \
+ unsigned short int: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, \
+ unsigned short int, 0, USHRT_MAX), \
+ int: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, \
+ int, INT_MIN, INT_MAX), \
+ unsigned int: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, \
+ unsigned int, 0, UINT_MAX), \
+ long int: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long int, \
+ long int, LONG_MIN, LONG_MAX), \
+ unsigned long int: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long int, \
+ unsigned long int, 0, ULONG_MAX), \
+ long long int: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long long int, \
+ long long int, LLONG_MIN, LLONG_MAX), \
+ unsigned long long int: \
+ _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long long int, \
+ unsigned long long int, 0, ULLONG_MAX)))
+#else
+/* Store the low-order bits of A <op> B into *R, where OP specifies
+ the operation and OVERFLOW the overflow predicate. If *R is
+ signed, its type is ST with bounds SMIN..SMAX; otherwise its type
+ is UT with bounds U..UMAX. ST and UT are narrower than int.
+ Return 1 if the result overflows. Arguments should not have side
+ effects, and A, B and *R can be of any integer type other than
+ char, bool, a bit-precise integer type, or an enumeration type. */
+# if _GL_HAVE___TYPEOF__
+# define _GL_INT_OP_WRAPV_SMALLISH(a,b,r,op,overflow,st,smin,smax,ut,umax) \
+ (_GL_TYPE_SIGNED (__typeof__ (*(r))) \
+ ? _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, st, smin, smax) \
+ : _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, ut, 0, umax))
+# else
+# define _GL_INT_OP_WRAPV_SMALLISH(a,b,r,op,overflow,st,smin,smax,ut,umax) \
+ (overflow (a, b, smin, smax) \
+ ? (overflow (a, b, 0, umax) \
+ ? (*(r) = _GL_INT_OP_WRAPV_VIA_UNSIGNED (a,b,op,unsigned,st), 1) \
+ : (*(r) = _GL_INT_OP_WRAPV_VIA_UNSIGNED (a,b,op,unsigned,st)) < 0) \
+ : (overflow (a, b, 0, umax) \
+ ? (*(r) = _GL_INT_OP_WRAPV_VIA_UNSIGNED (a,b,op,unsigned,st)) >= 0 \
+ : (*(r) = _GL_INT_OP_WRAPV_VIA_UNSIGNED (a,b,op,unsigned,st), 0)))
+# endif
+
+# define _GL_INT_OP_WRAPV(a, b, r, op, overflow) \
+ (sizeof *(r) == sizeof (signed char) \
+ ? _GL_INT_OP_WRAPV_SMALLISH (a, b, r, op, overflow, \
+ signed char, SCHAR_MIN, SCHAR_MAX, \
+ unsigned char, UCHAR_MAX) \
+ : sizeof *(r) == sizeof (short int) \
+ ? _GL_INT_OP_WRAPV_SMALLISH (a, b, r, op, overflow, \
+ short int, SHRT_MIN, SHRT_MAX, \
+ unsigned short int, USHRT_MAX) \
+ : sizeof *(r) == sizeof (int) \
+ ? (_GL_EXPR_SIGNED (*(r)) \
+ ? _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, \
+ int, INT_MIN, INT_MAX) \
+ : _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned int, \
+ unsigned int, 0, UINT_MAX)) \
+ : _GL_INT_OP_WRAPV_LONGISH(a, b, r, op, overflow))
+# ifdef LLONG_MAX
+# define _GL_INT_OP_WRAPV_LONGISH(a, b, r, op, overflow) \
+ (sizeof *(r) == sizeof (long int) \
+ ? (_GL_EXPR_SIGNED (*(r)) \
+ ? _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long int, \
+ long int, LONG_MIN, LONG_MAX) \
+ : _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long int, \
+ unsigned long int, 0, ULONG_MAX)) \
+ : (_GL_EXPR_SIGNED (*(r)) \
+ ? _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long long int, \
+ long long int, LLONG_MIN, LLONG_MAX) \
+ : _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long long int, \
+ unsigned long long int, 0, ULLONG_MAX)))
+# else
+# define _GL_INT_OP_WRAPV_LONGISH(a, b, r, op, overflow) \
+ (_GL_EXPR_SIGNED (*(r)) \
+ ? _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long int, \
+ long int, LONG_MIN, LONG_MAX) \
+ : _GL_INT_OP_CALC (a, b, r, op, overflow, unsigned long int, \
+ unsigned long int, 0, ULONG_MAX))
+# endif
+#endif
+
+/* Store the low-order bits of A <op> B into *R, where the operation
+ is given by OP. Use the unsigned type UT for calculation to avoid
+ overflow problems. *R's type is T, with extrema TMIN and TMAX.
+ T can be any signed integer type other than char, bool, a
+ bit-precise integer type, or an enumeration type.
+ Return 1 if the result overflows. */
+#define _GL_INT_OP_CALC(a, b, r, op, overflow, ut, t, tmin, tmax) \
+ (overflow (a, b, tmin, tmax) \
+ ? (*(r) = _GL_INT_OP_WRAPV_VIA_UNSIGNED (a, b, op, ut, t), 1) \
+ : (*(r) = _GL_INT_OP_WRAPV_VIA_UNSIGNED (a, b, op, ut, t), 0))
+
+/* Return 1 if the integer expressions A - B and -A would overflow,
+ respectively. Arguments should not have side effects,
+ and can be any signed integer type other than char, bool, a
+ bit-precise integer type, or an enumeration type.
+ These macros are tuned for their last input argument being a constant. */
+
+#if _GL_HAS_BUILTIN_OVERFLOW_P
+# define _GL_INT_NEGATE_OVERFLOW(a) \
+ __builtin_sub_overflow_p (0, a, (__typeof__ (- (a))) 0)
+#else
+# define _GL_INT_NEGATE_OVERFLOW(a) \
+ _GL_INT_NEGATE_RANGE_OVERFLOW (a, _GL_INT_MINIMUM (a), _GL_INT_MAXIMUM (a))
+#endif
+
+/* Return the low-order bits of A <op> B, where the operation is given
+ by OP. Use the unsigned type UT for calculation to avoid undefined
+ behavior on signed integer overflow, and convert the result to type T.
+ UT is at least as wide as T and is no narrower than unsigned int,
+ T is two's complement, and there is no padding or trap representations.
+ Assume that converting UT to T yields the low-order bits, as is
+ done in all known two's-complement C compilers. E.g., see:
+ https://gcc.gnu.org/onlinedocs/gcc/Integers-implementation.html
+
+ According to the C standard, converting UT to T yields an
+ implementation-defined result or signal for values outside T's
+ range. However, code that works around this theoretical problem
+ runs afoul of a compiler bug in Oracle Studio 12.3 x86. See:
+ https://lists.gnu.org/r/bug-gnulib/2017-04/msg00049.html
+ As the compiler bug is real, don't try to work around the
+ theoretical problem. */
+
+#define _GL_INT_OP_WRAPV_VIA_UNSIGNED(a, b, op, ut, t) \
+ ((t) ((ut) (a) op (ut) (b)))
+
+/* Return true if the numeric values A + B, A - B, A * B fall outside
+ the range TMIN..TMAX. Arguments should not have side effects
+ and can be any integer type other than char, bool,
+ a bit-precise integer type, or an enumeration type.
+ TMIN should be signed and nonpositive.
+ TMAX should be positive, and should be signed unless TMIN is zero. */
+#define _GL_INT_ADD_RANGE_OVERFLOW(a, b, tmin, tmax) \
+ ((b) < 0 \
+ ? (((tmin) \
+ ? ((_GL_EXPR_SIGNED (_GL_INT_CONVERT (a, (tmin) - (b))) || (b) < (tmin)) \
+ && (a) < (tmin) - (b)) \
+ : (a) <= -1 - (b)) \
+ || ((_GL_EXPR_SIGNED (a) ? 0 <= (a) : (tmax) < (a)) && (tmax) < (a) + (b))) \
+ : (a) < 0 \
+ ? (((tmin) \
+ ? ((_GL_EXPR_SIGNED (_GL_INT_CONVERT (b, (tmin) - (a))) || (a) < (tmin)) \
+ && (b) < (tmin) - (a)) \
+ : (b) <= -1 - (a)) \
+ || ((_GL_EXPR_SIGNED (_GL_INT_CONVERT (a, b)) || (tmax) < (b)) \
+ && (tmax) < (a) + (b))) \
+ : (tmax) < (b) || (tmax) - (b) < (a))
+#define _GL_INT_SUBTRACT_RANGE_OVERFLOW(a, b, tmin, tmax) \
+ (((a) < 0) == ((b) < 0) \
+ ? ((a) < (b) \
+ ? !(tmin) || -1 - (tmin) < (b) - (a) - 1 \
+ : (tmax) < (a) - (b)) \
+ : (a) < 0 \
+ ? ((!_GL_EXPR_SIGNED (_GL_INT_CONVERT ((a) - (tmin), b)) && (a) - (tmin) < 0) \
+ || (a) - (tmin) < (b)) \
+ : ((! (_GL_EXPR_SIGNED (_GL_INT_CONVERT (tmax, b)) \
+ && _GL_EXPR_SIGNED (_GL_INT_CONVERT ((tmax) + (b), a))) \
+ && (tmax) <= -1 - (b)) \
+ || (tmax) + (b) < (a)))
+#define _GL_INT_MULTIPLY_RANGE_OVERFLOW(a, b, tmin, tmax) \
+ ((b) < 0 \
+ ? ((a) < 0 \
+ ? (_GL_EXPR_SIGNED (_GL_INT_CONVERT (tmax, b)) \
+ ? (a) < (tmax) / (b) \
+ : ((_GL_INT_NEGATE_OVERFLOW (b) \
+ ? _GL_INT_CONVERT (b, tmax) >> (_GL_TYPE_WIDTH (+ (b)) - 1) \
+ : (tmax) / -(b)) \
+ <= -1 - (a))) \
+ : _GL_INT_NEGATE_OVERFLOW (_GL_INT_CONVERT (b, tmin)) && (b) == -1 \
+ ? (_GL_EXPR_SIGNED (a) \
+ ? 0 < (a) + (tmin) \
+ : 0 < (a) && -1 - (tmin) < (a) - 1) \
+ : (tmin) / (b) < (a)) \
+ : (b) == 0 \
+ ? 0 \
+ : ((a) < 0 \
+ ? (_GL_INT_NEGATE_OVERFLOW (_GL_INT_CONVERT (a, tmin)) && (a) == -1 \
+ ? (_GL_EXPR_SIGNED (b) ? 0 < (b) + (tmin) : -1 - (tmin) < (b) - 1) \
+ : (tmin) / (a) < (b)) \
+ : (tmax) / (b) < (a)))
+
+#endif /* _GL_INTPROPS_INTERNAL_H */
diff --git a/include/stdckdint.in.h b/include/stdckdint.in.h
new file mode 100644
index 00000000..91848806
--- /dev/null
+++ b/include/stdckdint.in.h
@@ -0,0 +1,35 @@
+/* stdckdint.h -- checked integer arithmetic
+
+ Copyright 2022-2024 Free Software Foundation, Inc.
+
+ This program is free software: you can redistribute it and/or modify it
+ under the terms of the GNU Lesser General Public License as published
+ by the Free Software Foundation; either version 2.1 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>. */
+
+#ifndef _GL_STDCKDINT_H
+#define _GL_STDCKDINT_H
+
+#include "intprops-internal.h"
+
+/* Store into *R the low-order bits of A + B, A - B, A * B, respectively.
+ Return 1 if the result overflows, 0 otherwise.
+ A, B, and *R can have any integer type other than char, bool, a
+ bit-precise integer type, or an enumeration type.
+
+ These are like the standard macros introduced in C23, except that
+ arguments should not have side effects. */
+
+#define ckd_add(r, a, b) ((bool) _GL_INT_ADD_WRAPV (a, b, r))
+#define ckd_sub(r, a, b) ((bool) _GL_INT_SUBTRACT_WRAPV (a, b, r))
+#define ckd_mul(r, a, b) ((bool) _GL_INT_MULTIPLY_WRAPV (a, b, r))
+
+#endif /* _GL_STDCKDINT_H */
--
2.44.0
From 41570a186dfb7c0c42e2a152668f1af74c284c49 Mon Sep 17 00:00:00 2001
From: Paul Eggert <egg...@cs.ucla.edu>
Date: Sun, 10 Mar 2024 12:11:35 -0700
Subject: [PATCH 2/4] Coalesce multiple PRIdMAX definitions
PRIdMAX is useful in multiple places, and as inttypes.h
defines it, move its definition to the include file that
includes inttypes.h, as it's logical to fix PRIdMAX just
after it's possibly incorrectly defined.
* bashtypes.h (PRIdMAX): Move definition here ...
* builtins/printf.def, examples/loadables/getconf.h:
* examples/loadables/seq.c: ... from these multiple locations.
---
bashtypes.h | 11 +++++++++++
builtins/printf.def | 12 ------------
examples/loadables/getconf.h | 8 --------
examples/loadables/seq.c | 12 ------------
4 files changed, 11 insertions(+), 32 deletions(-)
diff --git a/bashtypes.h b/bashtypes.h
index 01afef4b..ceb08e59 100644
--- a/bashtypes.h
+++ b/bashtypes.h
@@ -35,6 +35,17 @@
# include <inttypes.h>
#endif
+#ifdef PRI_MACROS_BROKEN
+# undef PRIdMAX
+#endif
+#ifndef PRIdMAX
+# if HAVE_LONG_LONG
+# define PRIdMAX "lld"
+# else
+# define PRIdMAX "ld"
+# endif
+#endif
+
#if HAVE_STDINT_H
# include <stdint.h>
#endif
diff --git a/builtins/printf.def b/builtins/printf.def
index f7f4de34..f711ed38 100644
--- a/builtins/printf.def
+++ b/builtins/printf.def
@@ -89,18 +89,6 @@ $END
#include "bashgetopt.h"
#include "common.h"
-#if defined (PRI_MACROS_BROKEN)
-# undef PRIdMAX
-#endif
-
-#if !defined (PRIdMAX)
-# if HAVE_LONG_LONG
-# define PRIdMAX "lld"
-# else
-# define PRIdMAX "ld"
-# endif
-#endif
-
#if !defined (errno)
extern int errno;
#endif
diff --git a/examples/loadables/getconf.h b/examples/loadables/getconf.h
index b8b9f102..98cc05e6 100644
--- a/examples/loadables/getconf.h
+++ b/examples/loadables/getconf.h
@@ -125,12 +125,4 @@
# define WORD_BIT (sizeof (int) * CHAR_BIT)
#endif
-#if !defined (PRIdMAX)
-# if HAVE_LONG_LONG
-# define PRIdMAX "lld"
-# else
-# define PRIdMAX "ld"
-# endif
-#endif
-
#endif /* _GETCONF_H */
diff --git a/examples/loadables/seq.c b/examples/loadables/seq.c
index 2a2be827..13834b8d 100644
--- a/examples/loadables/seq.c
+++ b/examples/loadables/seq.c
@@ -35,18 +35,6 @@
extern int errno;
#endif
-#if defined (PRI_MACROS_BROKEN)
-# undef PRIdMAX
-#endif
-
-#if !defined (PRIdMAX)
-# if HAVE_LONG_LONG
-# define PRIdMAX "lld"
-# else
-# define PRIdMAX "ld"
-# endif
-#endif
-
#if defined (HAVE_LONG_DOUBLE) && HAVE_DECL_STRTOLD && !defined(STRTOLD_BROKEN)
typedef long double floatmax_t;
# define FLOATMAX_CONV "L"
--
2.44.0
From 26617f122b800d1b70a903cf9233ed5f233dda1a Mon Sep 17 00:00:00 2001
From: Paul Eggert <egg...@cs.ucla.edu>
Date: Mon, 11 Mar 2024 23:36:38 -0700
Subject: [PATCH 3/4] Fix problems with large brace expansions
Do not mishandle brace expansions with more than INT_MAX elements.
Check more carefully for integer overflow in brace expansions.
Use C23-style checking for integer overflow, as that is more
future-proof.
* braces.c: Include <stdckdint.h>.
(mkseq): Width arg is size_t, not int, to avoid imposing
an arbitrary limit. All uses changed.
Do not assume number of elements fits in int, or that
INT_MAX <= SIZE_MAX. Simplify overflow checks.
Add a FIXME about an unlikely crash on interrupt.
Zero pad by hand, since asprintf cannot handle widths > INT_MAX.
* include/typemax.h (sh_imaxabs, ADDOVERFLOW, SUBOVERFLOW):
Remove; no longer used.
* lib/sh/stringvec.c: Include <stdckdint.h>.
(strvec_mcreate): Check for integer overflow.
(strvec_flush): Don't assume vector size fits in int.
* stringlib.c (substring): Don't assume string size fits in int.
---
braces.c | 165 ++++++++++++++++++++++-----------------------
externs.h | 2 +-
include/typemax.h | 19 ------
lib/sh/stringvec.c | 6 +-
stringlib.c | 4 +-
5 files changed, 87 insertions(+), 109 deletions(-)
diff --git a/braces.c b/braces.c
index 17d28073..860c228a 100644
--- a/braces.c
+++ b/braces.c
@@ -32,6 +32,7 @@
#endif
#include <errno.h>
+#include <stdckdint.h>
#include "bashansi.h"
#include "bashintl.h"
@@ -77,7 +78,7 @@ static const int brace_arg_separator = ',';
static int brace_gobbler (char *, size_t, int *, int);
static char **expand_amble (char *, size_t, int);
static char **expand_seqterm (char *, size_t);
-static char **mkseq (intmax_t, intmax_t, intmax_t, int, int);
+static char **mkseq (intmax_t, intmax_t, intmax_t, int, size_t);
static char **array_concat (char **, char **);
#if 0
@@ -349,120 +350,114 @@ expand_amble (char *text, size_t tlen, int flags)
#define ST_ZINT 3
static char **
-mkseq (intmax_t start, intmax_t end, intmax_t incr, int type, int width)
+mkseq (intmax_t start, intmax_t end, intmax_t incr, int type, size_t width)
{
- intmax_t n, prevn;
- int i, nelem;
+ intmax_t prevn, abs_incr;
+ size_t nelem;
char **result, *t;
+ char lbuf[INT_BUFSIZE_BOUND (uintmax_t)];
if (incr == 0)
incr = 1;
- if (start > end && incr > 0)
- incr = -incr;
- else if (start < end && incr < 0)
- {
- if (incr == INTMAX_MIN) /* Don't use -INTMAX_MIN */
- return ((char **)NULL);
- incr = -incr;
- }
-
- /* Check that end-start will not overflow INTMAX_MIN, INTMAX_MAX. The +3
- and -2, not strictly necessary, are there because of the way the number
- of elements and value passed to strvec_create() are calculated below. */
- if (SUBOVERFLOW (end, start, INTMAX_MIN+3, INTMAX_MAX-2))
+ /* abs_incr = abs (incr) */
+ abs_incr = incr;
+ if (incr < 0 && ckd_sub (&abs_incr, 0, incr))
return ((char **)NULL);
- prevn = sh_imaxabs (end - start);
- /* Need to check this way in case INT_MAX == INTMAX_MAX */
- if (INT_MAX == INTMAX_MAX && (ADDOVERFLOW (prevn, 2, INT_MIN, INT_MAX)))
+ /* Negate incr if it disagrees with start < end. */
+ if ((start < end) == (incr < 0) && ckd_sub (&incr, 0, incr))
return ((char **)NULL);
- /* Make sure the assignment to nelem below doesn't end up <= 0 due to
- intmax_t overflow */
- else if (ADDOVERFLOW ((prevn/sh_imaxabs(incr)), 1, INTMAX_MIN, INTMAX_MAX))
+
+ /* prevn = abs (end - start); */
+ if (start < end
+ ? ckd_sub (&prevn, end, start)
+ : ckd_sub (&prevn, start, end))
return ((char **)NULL);
- /* XXX - TOFIX: potentially allocating a lot of extra memory if
- imaxabs(incr) != 1 */
- /* Instead of a simple nelem = prevn + 1, something like:
- nelem = (prevn / imaxabs(incr)) + 1;
- would work */
- if ((prevn / sh_imaxabs (incr)) > INT_MAX - 3) /* check int overflow */
+ /* The number of elements is floor (abs ((end - start) / incr)),
+ plus 1 for the first element, plus 1 for trailing nullptr. */
+ if (ckd_add (&nelem, prevn / abs_incr, 1 + 1))
return ((char **)NULL);
- nelem = (prevn / sh_imaxabs(incr)) + 1;
- result = strvec_mcreate (nelem + 1);
- if (result == 0)
- {
- internal_error (_("brace expansion: failed to allocate memory for %u elements"), (unsigned int)nelem);
- return ((char **)NULL);
- }
- /* Make sure we go through the loop at least once, so {3..3} prints `3' */
- i = 0;
- n = start;
- do
+ result = strvec_mcreate (nelem);
+ if (result)
{
+ /* Go through the loop at least once, so {3..3} expands to 3. */
+ size_t i = 0;
+ intmax_t n;
+ for (n = start; ; n += incr)
+ {
#if defined (SHELL)
- if (ISINTERRUPT)
- {
- result[i] = (char *)NULL;
- strvec_dispose (result);
- result = (char **)NULL;
- }
- QUIT;
+ if (ISINTERRUPT)
+ {
+ result[i] = (char *)NULL;
+ strvec_dispose (result);
+ result = (char **)NULL;
+ /* FIXME: This crashes if QUIT does not throw to the
+ top level, which seems possible albeit unlikely. */
+ }
+ QUIT;
#endif
- if (type == ST_INT)
- result[i++] = t = itos (n);
- else if (type == ST_ZINT)
- {
- int len, arg;
- arg = n;
- len = asprintf (&t, "%0*d", width, arg);
- result[i++] = t;
- }
- else
- {
- if (t = (char *)malloc (2))
+ if (type == ST_CHAR)
{
- t[0] = n;
- t[1] = '\0';
+ t = (char *)malloc (2);
+ if (t)
+ {
+ t[0] = n;
+ t[1] = '\0';
+ }
+ }
+ else
+ {
+ t = itos (n);
+ if (type == ST_ZINT)
+ {
+ size_t tlen = strlen (t);
+ if (tlen < width)
+ {
+ /* Zero pad the result directly, as sprintf
+ does not work when INT_MAX < width. */
+ char *t0 = t;
+ t = realloc (t, width + 1);
+ if (!t)
+ free (t0);
+ else
+ {
+ memmove (t + (width - tlen), t, tlen + 1);
+ memset (t + (n < 0), '0', width - tlen);
+ }
+ }
+ }
}
- result[i++] = t;
- }
- /* We failed to allocate memory for this number, so we bail. */
- if (t == 0)
- {
- char *p, lbuf[INT_STRLEN_BOUND(intmax_t) + 1];
-
- /* Easier to do this than mess around with various intmax_t printf
- formats (%ld? %lld? %jd?) and PRIdMAX. */
- p = inttostr (n, lbuf, sizeof (lbuf));
- internal_error (_("brace expansion: failed to allocate memory for `%s'"), p);
- strvec_dispose (result);
- return ((char **)NULL);
- }
+ result[i++] = t;
- /* Handle overflow and underflow of n+incr */
- if (ADDOVERFLOW (n, incr, INTMAX_MIN, INTMAX_MAX))
- break;
+ /* Bail if we failed to allocate memory for this number. */
+ if (!t)
+ break;
- n += incr;
+ if (i == nelem - 1)
+ {
+ result[i] = (char *)0;
+ return (result);
+ }
+ }
- if ((incr < 0 && n < end) || (incr > 0 && n > end))
- break;
+ strvec_dispose (result);
}
- while (1);
- result[i] = (char *)0;
- return (result);
+ internal_error (_("brace expansion: cannot allocate %s elements"),
+ uinttostr (nelem - 1, lbuf, sizeof (lbuf)));
+ return ((char **)NULL);
}
static char **
expand_seqterm (char *text, size_t tlen)
{
char *t, *lhs, *rhs;
- int lhs_t, rhs_t, lhs_l, rhs_l, width;
+ int lhs_t, rhs_t;
+ size_t lhs_l, rhs_l, width;
intmax_t lhs_v, rhs_v, incr;
intmax_t tl, tr;
char **result, *ep, *oep;
diff --git a/externs.h b/externs.h
index 6376bf41..b60fb79e 100644
--- a/externs.h
+++ b/externs.h
@@ -164,7 +164,7 @@ extern int find_string_in_alist (char *, STRING_INT_ALIST *, int);
extern char *find_token_in_alist (int, STRING_INT_ALIST *, int);
extern int find_index_in_alist (char *, STRING_INT_ALIST *, int);
-extern char *substring (const char *, int, int);
+extern char *substring (const char *, size_t, size_t);
extern char *strsub (const char *, const char *, const char *, int);
extern char *strcreplace (const char *, int, const char *, int);
extern void strip_leading (char *);
diff --git a/include/typemax.h b/include/typemax.h
index e3b98f47..c93fda73 100644
--- a/include/typemax.h
+++ b/include/typemax.h
@@ -119,23 +119,4 @@ static const unsigned long long int maxquad = ULLONG_MAX;
# define SIZE_MAX ((size_t) ~(size_t)0)
#endif
-#ifndef sh_imaxabs
-# define sh_imaxabs(x) (((x) >= 0) ? (x) : -(x))
-#endif
-
-/* Handle signed arithmetic overflow and underflow. Have to do it this way
- to avoid compilers optimizing out simpler overflow checks. */
-
-/* Make sure that a+b does not exceed MAXV or is smaller than MINV (if b < 0).
- Assumes that b > 0 if a > 0 and b < 0 if a < 0 */
-#define ADDOVERFLOW(a,b,minv,maxv) \
- ((((a) > 0) && ((b) > ((maxv) - (a)))) || \
- (((a) < 0) && ((b) < ((minv) - (a)))))
-
-/* Make sure that a-b is not smaller than MINV or exceeds MAXV (if b < 0).
- Assumes that b > 0 if a > 0 and b < 0 if a < 0 */
-#define SUBOVERFLOW(a,b,minv,maxv) \
- ((((b) > 0) && ((a) < ((minv) + (b)))) || \
- (((b) < 0) && ((a) > ((maxv) + (b)))))
-
#endif /* _SH_TYPEMAX_H */
diff --git a/lib/sh/stringvec.c b/lib/sh/stringvec.c
index bf57d688..01e65a87 100644
--- a/lib/sh/stringvec.c
+++ b/lib/sh/stringvec.c
@@ -27,6 +27,7 @@
#endif
#include <bashansi.h>
+#include <stdckdint.h>
#include <stdio.h>
#include <chartypes.h>
@@ -43,7 +44,8 @@ strvec_create (size_t n)
char **
strvec_mcreate (size_t n)
{
- return ((char **)malloc ((n) * sizeof (char *)));
+ size_t nbytes;
+ return ckd_mul (&nbytes, n, sizeof (char *)) ? NULL : malloc (nbytes);
}
char **
@@ -72,7 +74,7 @@ strvec_len (char * const *array)
void
strvec_flush (char **array)
{
- register int i;
+ register size_t i;
if (array == 0)
return;
diff --git a/stringlib.c b/stringlib.c
index 7c24df62..fcfd5e2d 100644
--- a/stringlib.c
+++ b/stringlib.c
@@ -115,9 +115,9 @@ find_index_in_alist (char *string, STRING_INT_ALIST *alist, int flags)
/* Cons a new string from STRING starting at START and ending at END,
not including END. */
char *
-substring (const char *string, int start, int end)
+substring (const char *string, size_t start, size_t end)
{
- int len;
+ size_t len;
char *result;
len = end - start;
--
2.44.0
From aa6a183700ba7afec42534fcc7b4b0b2b5c89891 Mon Sep 17 00:00:00 2001
From: Paul Eggert <egg...@cs.ucla.edu>
Date: Tue, 12 Mar 2024 12:27:48 -0700
Subject: [PATCH 4/4] printf now diagnoses width or prec overflow
* printf.def: Include stdckdint.h.
(skipint, scanint): New functions, replacing decodeprec.
All uses changed.
(printf_builtin, printstr, printwidestr):
Diagnose out-of-range widths and precisions instead of relying on
undefined behavior, or silently doing the wrong thing.
(getint): New arg IFOVERFLOW. All uses changed.
Check for overflow properly.
---
builtins/printf.def | 147 +++++++++++++++++++++-----------------------
1 file changed, 69 insertions(+), 78 deletions(-)
diff --git a/builtins/printf.def b/builtins/printf.def
index f711ed38..c801ec10 100644
--- a/builtins/printf.def
+++ b/builtins/printf.def
@@ -69,7 +69,7 @@ $END
#endif
#include <stdarg.h>
-
+#include <stdckdint.h>
#include <stdio.h>
#include <chartypes.h>
@@ -200,7 +200,7 @@ static int vbprintf (const char *, ...) __attribute__((__format__ (printf, 1, 2)
static char *mklong (char *, char *, size_t);
static int getchr (void);
static char *getstr (void);
-static int getint (void);
+static int getint (int);
static intmax_t getintmax (void);
static uintmax_t getuintmax (void);
@@ -244,22 +244,55 @@ static intmax_t tw;
static char *conv_buf;
static size_t conv_bufsize;
+/* Skip the unsigned decimal integer prefix, if any, of STR,
+ and return the address of the first byte after the prefix.
+ If DIAGNOSE< diagnose if the integer would not fit in int. */
+static char *
+skipint (char *str, int diagnose)
+{
+ char *ps = str;
+ int pr = 0;
+ int v = 0;
+
+ for (; DIGIT (*ps); ps++)
+ {
+ v |= ckd_mul (&pr, pr, 10);
+ v |= ckd_add (&pr, pr, *ps - '0');
+ }
+ if (v && diagnose)
+ {
+ char *prefix = substring (str, 0, ps - str);
+ printf_erange (prefix);
+ free (prefix);
+ }
+ return ps;
+}
+
+/* Convert the unsigned decimal integer at *STR to int.
+ **STR must be a digit.
+ Update *STR to point past the end of the integer.
+ Return the scanned value, or IFOVERFLOW if it would not fit in int. */
static inline int
-decodeprec (char *ps)
+scanint (char **str, int ifoverflow)
{
- intmax_t mpr;
+ char *ps = *str;
+ int pr = *ps++ - '0';
+ int v = 0;
- mpr = *ps++ - '0';
- while (DIGIT (*ps))
- mpr = (mpr * 10) + (*ps++ - '0');
- return (mpr < 0 || mpr > INT_MAX) ? INT_MAX : mpr;
+ for (; DIGIT (*ps); ps++)
+ {
+ v |= ckd_mul (&pr, pr, 10);
+ v |= ckd_add (&pr, pr, *ps - '0');
+ }
+ *str = ps;
+ return v ? ifoverflow : pr;
}
int
printf_builtin (WORD_LIST *list)
{
int ch, fieldwidth, precision;
- int have_fieldwidth, have_precision, use_Lmod, altform, longform;
+ int have_fieldwidth, have_precision, use_Lmod, altform, longform, diagnose;
char convch, thisch, nextch, *format, *modstart, *precstart, *fmt, *start;
#if defined (HANDLE_MULTIBYTE)
char mbch[25]; /* 25 > MB_LEN_MAX, plus can handle 4-byte UTF-8 and large Unicode characters*/
@@ -330,6 +363,7 @@ printf_builtin (WORD_LIST *list)
format = list->word->word;
tw = 0;
+ diagnose = 1;
retval = EXECUTION_SUCCESS;
garglist = orig_arglist = list->next;
@@ -407,14 +441,10 @@ printf_builtin (WORD_LIST *list)
{
fmt++;
have_fieldwidth = 1;
- fieldwidth = getint ();
- /* Handle field with overflow by ignoring it. */
- if (fieldwidth == INT_MAX || fieldwidth == INT_MIN)
- fieldwidth = 0;
+ fieldwidth = getint (0);
}
else
- while (DIGIT (*fmt))
- fmt++;
+ fmt = skipint (fmt, diagnose);
/* Skip optional '.' and precision */
if (*fmt == '.')
@@ -424,11 +454,7 @@ printf_builtin (WORD_LIST *list)
{
fmt++;
have_precision = 1;
- precision = getint ();
- /* Handle precision overflow by ignoring it. "A negative
- precision is treated as if it were missing." */
- if (precision == INT_MAX || precision == INT_MIN)
- precision = -1;
+ precision = getint (-1);
}
else
{
@@ -443,9 +469,10 @@ printf_builtin (WORD_LIST *list)
#endif
fmt++;
if (DIGIT (*fmt))
- precstart = fmt;
- while (DIGIT (*fmt))
- fmt++;
+ {
+ precstart = fmt;
+ fmt = skipint (fmt, diagnose);
+ }
}
}
@@ -660,7 +687,10 @@ printf_builtin (WORD_LIST *list)
if (convch == 'Q' && (have_precision || precstart))
{
if (precstart)
- precision = decodeprec (precstart);
+ {
+ char *prec = precstart;
+ precision = scanint (&prec, -1);
+ }
slen = strlen (p);
/* printf precision works in bytes. */
if (precision >= 0 && precision < slen)
@@ -700,8 +730,8 @@ printf_builtin (WORD_LIST *list)
long p;
intmax_t pp;
- p = pp = getintmax ();
- if (p != pp)
+ pp = getintmax ();
+ if (! (LONG_MIN <= pp && pp <= LONG_MAX))
{
f = mklong (start, PRIdMAX, sizeof (PRIdMAX) - 2);
PF (f, pp);
@@ -712,6 +742,7 @@ printf_builtin (WORD_LIST *list)
in "long". This also works around some long
long and/or intmax_t library bugs in the common
case, e.g. glibc 2.2 x86. */
+ p = pp;
f = mklong (start, "l", 1);
PF (f, p);
}
@@ -790,6 +821,8 @@ printf_builtin (WORD_LIST *list)
/* PRETURN will print error message. */
PRETURN (EXECUTION_FAILURE);
}
+
+ diagnose = 0;
}
while (garglist && garglist != list->next);
@@ -823,7 +856,6 @@ printstr (char *fmt, char *string, int len, int fieldwidth, int precision)
#endif
int padlen, nc, ljust, i;
int fw, pr; /* fieldwidth and precision */
- intmax_t mfw, mpr;
if (string == 0)
string = "";
@@ -834,10 +866,8 @@ printstr (char *fmt, char *string, int len, int fieldwidth, int precision)
if (*fmt == '%')
fmt++;
- ljust = fw = 0;
+ ljust = 0;
pr = -1;
- mfw = 0;
- mpr = -1;
/* skip flags */
while (strchr (SKIP1, *fmt))
@@ -859,13 +889,7 @@ printstr (char *fmt, char *string, int len, int fieldwidth, int precision)
}
}
else if (DIGIT (*fmt))
- {
- mfw = *fmt++ - '0';
- while (DIGIT (*fmt))
- mfw = (mfw * 10) + (*fmt++ - '0');
- /* Error if fieldwidth > INT_MAX here? */
- fw = (mfw < 0 || mfw > INT_MAX) ? INT_MAX : mfw;
- }
+ fw = scanint (&fmt, 0);
/* get precision, if present. doesn't handle negative precisions */
if (*fmt == '.')
@@ -877,15 +901,7 @@ printstr (char *fmt, char *string, int len, int fieldwidth, int precision)
pr = precision;
}
else if (DIGIT (*fmt))
- {
- mpr = *fmt++ - '0';
- while (DIGIT (*fmt))
- mpr = (mpr * 10) + (*fmt++ - '0');
- /* Error if precision > INT_MAX here? */
- pr = (mpr < 0 || mpr > INT_MAX) ? INT_MAX : mpr;
- if (pr < precision && precision < INT_MAX)
- pr = precision; /* XXX */
- }
+ pr = scanint (&fmt, -1);
else
pr = 0; /* "a null digit string is treated as zero" */
}
@@ -934,7 +950,6 @@ printwidestr (char *fmt, wchar_t *wstring, size_t len, int fieldwidth, int preci
char *string;
int padlen, nc, ljust, i;
int fw, pr; /* fieldwidth and precision */
- intmax_t mfw, mpr;
if (wstring == 0)
wstring = L"";
@@ -947,8 +962,6 @@ printwidestr (char *fmt, wchar_t *wstring, size_t len, int fieldwidth, int preci
ljust = fw = 0;
pr = -1;
- mfw = 0;
- mpr = -1;
/* skip flags */
while (strchr (SKIP1, *fmt))
@@ -970,13 +983,7 @@ printwidestr (char *fmt, wchar_t *wstring, size_t len, int fieldwidth, int preci
}
}
else if (DIGIT (*fmt))
- {
- mfw = *fmt++ - '0';
- while (DIGIT (*fmt))
- mfw = (mfw * 10) + (*fmt++ - '0');
- /* Error if fieldwidth > INT_MAX here? */
- fw = (mfw < 0 || mfw > INT_MAX) ? INT_MAX : mfw;
- }
+ fw = scanint (&fmt, 0);
/* get precision, if present. doesn't handle negative precisions */
if (*fmt == '.')
@@ -988,15 +995,7 @@ printwidestr (char *fmt, wchar_t *wstring, size_t len, int fieldwidth, int preci
pr = precision;
}
else if (DIGIT (*fmt))
- {
- mpr = *fmt++ - '0';
- while (DIGIT (*fmt))
- mpr = (mpr * 10) + (*fmt++ - '0');
- /* Error if precision > INT_MAX here? */
- pr = (mpr < 0 || mpr > INT_MAX) ? INT_MAX : mpr;
- if (pr < precision && precision < INT_MAX)
- pr = precision; /* XXX */
- }
+ pr = scanint (&fmt, -1);
else
pr = 0; /* "a null digit string is treated as zero" */
}
@@ -1346,10 +1345,11 @@ getstr (void)
/* Don't call getintmax here because it may consume an argument on error, and
we call this to get field width/precision arguments. */
static int
-getint (void)
+getint (int ifoverflow)
{
intmax_t ret;
char *ep;
+ int overflow;
if (garglist == 0)
return (0);
@@ -1359,27 +1359,18 @@ getint (void)
errno = 0;
ret = strtoimax (garglist->word->word, &ep, 0);
+ overflow = errno == ERANGE || ! (-INT_MAX <= ret && ret <= INT_MAX);
if (*ep)
{
sh_invalidnum (garglist->word->word);
conversion_error = 1;
}
- else if (errno == ERANGE)
+ else if (overflow)
printf_erange (garglist->word->word);
- else if (ret > INT_MAX)
- {
- printf_erange (garglist->word->word);
- ret = INT_MAX;
- }
- else if (ret < INT_MIN)
- {
- printf_erange (garglist->word->word);
- ret = INT_MIN;
- }
garglist = garglist->next;
- return ((int)ret);
+ return (overflow ? ifoverflow : (int)ret);
}
static intmax_t
--
2.44.0
