Re: [PATCH] libstdc++: fix buffer overflow in path::operator+= (PR92853)

[Jonathan Wakely]

On 09/12/19 09:55 +0000, Jonathan Wakely wrote:

When concatenating a path ending in a root-directory onto another path,
we added an empty filename to the end of the path twice, but only
reserved space for one. That meant the second write went past the end of
the allocated buffer.

        PR libstdc++/92853
        * src/c++17/fs_path.cc (filesystem::path::operator+=(const path&)):
        Do not process a trailing directory separator twice.
        * testsuite/27_io/filesystem/path/concat/92853.cc: New test.
        * testsuite/27_io/filesystem/path/concat/path.cc: Test more cases.

This adds similar improvements to the test for operator+= for strings,
rather than operator+=(const path&).

Tested x86_64-linux, committed to trunk. I'll backport this to
gcc-9-branch too.



commit 43a2985ffbff0a4c80da0dcc01162a02f9158cdb
Author: Jonathan Wakely <jwak...@redhat.com>
Date:   Mon Dec 9 09:57:48 2019 +0000

    libstdc++: Improve testing for path::operator+=(const string&)
    
            * testsuite/27_io/filesystem/path/concat/strings.cc: Test more cases.

diff --git a/libstdc++-v3/testsuite/27_io/filesystem/path/concat/strings.cc b/libstdc++-v3/testsuite/27_io/filesystem/path/concat/strings.cc
index 80ce25ef119..f51707b171c 100644
--- a/libstdc++-v3/testsuite/27_io/filesystem/path/concat/strings.cc
+++ b/libstdc++-v3/testsuite/27_io/filesystem/path/concat/strings.cc
@@ -113,10 +113,29 @@ test03()
   p4 += s;
   compare_paths(p4, path(s0+'/'+s));
 }
+
+void
+test04()
+{
+  // Concat every test path onto every test path.
+  for (path p : __gnu_test::test_paths)
+  {
+    for (path x : __gnu_test::test_paths)
+    {
+      auto prior_native = p.native();
+      p += x.native();
+      VERIFY( p.native() == prior_native + x.native() );
+      path copy(p);
+      compare_paths( copy, p );
+    }
+  }
+}
+
 int
 main()
 {
   test01();
   test02();
   test03();
+  test04();
 }