You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@stdcxx.apache.org by "Martin Sebor (JIRA)" <ji...@apache.org> on 2005/11/19 01:57:41 UTC
[jira] Created: (STDCXX-69) [MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer
[MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer
----------------------------------------------------------------------------
Key: STDCXX-69
URL: http://issues.apache.org/jira/browse/STDCXX-69
Project: STDCXX
Type: Bug
Versions: 4.1.2
Environment: MSVC 6, 8
Reporter: Martin Sebor
Fix For: 4.1.3
When compiled with MSVC 6 and 8 (but not 7.1), the program below segfaults at runtime:
$ cat t.cpp ; cl t.cpp && ./t.exe
#include <locale.h>
#include <wchar.h>
int main ()
{
if (setlocale (LC_COLLATE, "ENU"))
wcsxfrm (0, L"\x83", 0);
}
Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 12.00.8168 for 80x86
Copyright (C) Microsoft Corp 1984-1998. All rights reserved.
t.cpp
t.cpp(8) : warning C4508: 'main' : function should return a value; 'void' return type assumed
Microsoft (R) Incremental Linker Version 6.00.8447
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
/out:t.exe
t.obj
[1] + Done(139) cat t.cpp ; cl t.cpp && ./t.exe
527 Segmentation violation ./t.exe
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Updated: (STDCXX-69) [MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer
Posted by "Martin Sebor (JIRA)" <ji...@apache.org>.
[ http://issues.apache.org/jira/browse/STDCXX-69?page=all ]
Martin Sebor updated STDCXX-69:
-------------------------------
Component: External
> [MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer
> ----------------------------------------------------------------------------
>
> Key: STDCXX-69
> URL: http://issues.apache.org/jira/browse/STDCXX-69
> Project: STDCXX
> Type: Bug
> Components: External
> Versions: 4.1.2
> Environment: MSVC 6, 8
> Reporter: Martin Sebor
> Fix For: 4.1.3
>
> When compiled with MSVC 6 and 8 (but not 7.1), the program below segfaults at runtime:
> $ cat t.cpp ; cl t.cpp && ./t.exe
> #include <locale.h>
> #include <wchar.h>
> int main ()
> {
> if (setlocale (LC_COLLATE, "ENU"))
> wcsxfrm (0, L"\x83", 0);
> }
> Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 12.00.8168 for 80x86
> Copyright (C) Microsoft Corp 1984-1998. All rights reserved.
> t.cpp
> t.cpp(8) : warning C4508: 'main' : function should return a value; 'void' return type assumed
> Microsoft (R) Incremental Linker Version 6.00.8447
> Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
> /out:t.exe
> t.obj
> [1] + Done(139) cat t.cpp ; cl t.cpp && ./t.exe
> 527 Segmentation violation ./t.exe
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Commented: (STDCXX-69) [MSVC 6,8] wcsxfrm (s1, s2, 0) writes
past the end of the destination buffer
Posted by "Farid Zaripov (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/STDCXX-69?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12531548 ]
Farid Zaripov commented on STDCXX-69:
-------------------------------------
This bug has been fixed in MSVC 9.0 beta2.
> [MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer
> ----------------------------------------------------------------------------
>
> Key: STDCXX-69
> URL: https://issues.apache.org/jira/browse/STDCXX-69
> Project: C++ Standard Library
> Issue Type: Bug
> Components: External
> Affects Versions: 4.1.2
> Environment: MSVC 6, 8
> Reporter: Martin Sebor
>
> When compiled with MSVC 6 and 8 (but not 7.1), the program below segfaults at runtime:
> $ cat t.cpp ; cl t.cpp && ./t.exe
> #include <locale.h>
> #include <wchar.h>
> int main ()
> {
> if (setlocale (LC_COLLATE, "ENU"))
> wcsxfrm (0, L"\x83", 0);
> }
> Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 12.00.8168 for 80x86
> Copyright (C) Microsoft Corp 1984-1998. All rights reserved.
> t.cpp
> t.cpp(8) : warning C4508: 'main' : function should return a value; 'void' return type assumed
> Microsoft (R) Incremental Linker Version 6.00.8447
> Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
> /out:t.exe
> t.obj
> [1] + Done(139) cat t.cpp ; cl t.cpp && ./t.exe
> 527 Segmentation violation ./t.exe
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (STDCXX-69) [MSVC 6,8] wcsxfrm (s1, s2, 0) writes
past the end of the destination buffer
Posted by "Martin Sebor (JIRA)" <ji...@apache.org>.
[ http://issues.apache.org/jira/browse/STDCXX-69?page=all ]
Martin Sebor updated STDCXX-69:
-------------------------------
Fix Version: (was: 4.1.3)
Can't fix or schedule bugs in external dependencies.
> [MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer
> ----------------------------------------------------------------------------
>
> Key: STDCXX-69
> URL: http://issues.apache.org/jira/browse/STDCXX-69
> Project: STDCXX
> Type: Bug
> Components: External
> Versions: 4.1.2
> Environment: MSVC 6, 8
> Reporter: Martin Sebor
>
> When compiled with MSVC 6 and 8 (but not 7.1), the program below segfaults at runtime:
> $ cat t.cpp ; cl t.cpp && ./t.exe
> #include <locale.h>
> #include <wchar.h>
> int main ()
> {
> if (setlocale (LC_COLLATE, "ENU"))
> wcsxfrm (0, L"\x83", 0);
> }
> Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 12.00.8168 for 80x86
> Copyright (C) Microsoft Corp 1984-1998. All rights reserved.
> t.cpp
> t.cpp(8) : warning C4508: 'main' : function should return a value; 'void' return type assumed
> Microsoft (R) Incremental Linker Version 6.00.8447
> Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
> /out:t.exe
> t.obj
> [1] + Done(139) cat t.cpp ; cl t.cpp && ./t.exe
> 527 Segmentation violation ./t.exe
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
[jira] Commented: (STDCXX-69) [MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer
Posted by "Martin Sebor (JIRA)" <ji...@apache.org>.
[ http://issues.apache.org/jira/browse/STDCXX-69?page=comments#action_12358052 ]
Martin Sebor commented on STDCXX-69:
------------------------------------
Filed here:
http://lab.msdn.microsoft.com/ProductFeedback/viewfeedback.aspx?feedbackid=fe5eb46e-228b-4e16-a4ff-fa8cba3b7955
======================================================================
Bug ID: FDBK40794
Problem Type: Bug
Status: New
Microsoft Status: Under Review
Opened Date: 2005-11-18 16:23:39
Opened By: Martin Sebor
Product/Technology: Visual C++
Version: Visual Studio 2005
Product Language: English
Category: Libraries
OS: Windows 2000 Server
OS Language: US English
Submission Language: English
======================================================================
Description:
Opened by Martin Sebor on 2005-11-18 at 16:23:39
Similarly to FDBK40793, the C standard library function wcsxfrm() corrupts memory past the end of the destination buffer.
Edited by Martin Sebor on 2005-11-18 at 16:29:41
FWIW, I see in our records that we reported this bug against MSVC 6 and that it was fixed in MSVC 7 (the test case passes with it), so this must be a regression.
======================================================================
Steps to Reproduce:
$ cat t.cpp && cl t.cpp && ./t.exe
#include <assert.h>
#include <locale.h>
#include <string.h>
int main ()
{
setlocale (LC_COLLATE, "ENU");
wchar_t s1 [2] = { L'*', L'*' };
wcsxfrm (s1, L"", 0);
assert (L'*' == s1 [0] && L'*' == s1 [1]);
}
Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 14.00.50727.42 for 80x86
Copyright (C) Microsoft Corporation. All rights reserved.
t.cpp
Microsoft (R) Incremental Linker Version 8.00.50727.42
Copyright (C) Microsoft Corporation. All rights reserved.
/out:t.exe
t.obj
Assertion failed: L'*' == s1 [0] && L'*' == s1 [1], file t.cpp, line 11
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
======================================================================
Actual Results: Runtime error.
Expected Results: No error.
> [MSVC 6,8] wcsxfrm (s1, s2, 0) writes past the end of the destination buffer
> ----------------------------------------------------------------------------
>
> Key: STDCXX-69
> URL: http://issues.apache.org/jira/browse/STDCXX-69
> Project: STDCXX
> Type: Bug
> Versions: 4.1.2
> Environment: MSVC 6, 8
> Reporter: Martin Sebor
> Fix For: 4.1.3
>
> When compiled with MSVC 6 and 8 (but not 7.1), the program below segfaults at runtime:
> $ cat t.cpp ; cl t.cpp && ./t.exe
> #include <locale.h>
> #include <wchar.h>
> int main ()
> {
> if (setlocale (LC_COLLATE, "ENU"))
> wcsxfrm (0, L"\x83", 0);
> }
> Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 12.00.8168 for 80x86
> Copyright (C) Microsoft Corp 1984-1998. All rights reserved.
> t.cpp
> t.cpp(8) : warning C4508: 'main' : function should return a value; 'void' return type assumed
> Microsoft (R) Incremental Linker Version 6.00.8447
> Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
> /out:t.exe
> t.obj
> [1] + Done(139) cat t.cpp ; cl t.cpp && ./t.exe
> 527 Segmentation violation ./t.exe
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira