summaryrefslogtreecommitdiff
path: root/lib/libc/stdio
AgeCommit message (Collapse)Author
2021-02-02article fixes; from eddie yousephJason McIntyre
2020-10-27The printf format string component %n is a nearly turning-complete gadget.Theo de Raadt
Largely considered attack surface nowadays. The benefit provided by %n is completely overshadowed by the risk. New uses of %n don't seem to be entering the C ecosystem, as static tools flag them. And everyone points fingers at those people.... The list of programs (and libraries) which use %n is therefore finite and shrinking. Most of the %n use comes out of the GNU ecosystem. jca@ has convinced gnulib to fix their code (so we need to wait for software including gnulib to make new releases). A few libraries have moved ahead of us and become more strict. Some n longer permit %n (for instance, andriod bionic). Others log the occurance. Some log and abort if the output location is W|X (MacOS). Our base tree is clean. The ports tree contains a handful during build time, and unknown count (more) during runtime. We would like to abort programs on any occurance of %n. Or we could be like MacOS, aborting for W|X pages (but would need a system call which can check that condition, and that introduces addressspace knowledge we don't want attackers to know, and may be a poor tradeoff). For now, we can syslog, to increase awareness, and involve more people in the greater community to remove %n uses. [If %n is at the end, use the *printf return value. If it occurs in the middle, split the printf calls into multiples] Hopefully one day, we can just abort() when %n happens. Help us get there? ok jca, plus naddy for ports team
2020-09-13Spell out n as en for consistency with other parts of the page.Theo Buehler
2020-09-13%lln is percent ell ell n (not dee).Claudio Jeker
OK deraadt@
2020-08-17Fix append mode so it always writes to the end and expand regress.Todd C. Miller
OK deraadt@ martijn@
2020-08-14Fix handling of "w+" mode, we were only truncating for "w".Todd C. Miller
OK martijn@ mpi@
2020-07-10adjust %n description to vaguely say "pointer", becuase the followingTheo de Raadt
list of "[size]n" includes "n" on it's own, thereby the "int" case is described correctly. ok schwarze
2020-07-10As suggested by deraadt@, rewrite most of the printf(3) manual pageIngo Schwarze
to properly show the (differing) syntaxes of all the conversion specifications, and reduce the amount of forward references from the list of modifiers to the list of specifiers. While here, properly explain %lc and %ls. Also correct RETURN VALUES, which incorrectly talked about counting characters while actually bytes are counted. Using feedback from millert@, deraadt@, tb@, and Martin Vahlensieck. OK deraadt@, millert@, and tb@ on intermediate versions of this diff and no objections from jmc@.
2020-07-06Minor tweaks in the description of %g:Ingo Schwarze
1. Clarify that %G uses %F, not %f; noticed by millert@. 2. Mention that %g originally meant "general notation", see: https://minnie.tuhs.org/cgi-bin/utree.pl?file=V7/usr/src/libc/stdio/doprnt.s Triggered by a somewhat different patch from Ian <ropers at gmail dot com>. Feedback and OK millert@ and jmc@.
2019-12-03fwide() does not unlock if error was occurred.asou
ok guenther@ and deraadt
2019-09-07more Version 1 AT&T UNIX history:Ingo Schwarze
a few cases that weren't altogether straightforward; tweak and OK jmc@, OK sobrado@
2019-08-30.Dt same as filenameTheo de Raadt
2019-08-30mop up stdarg rename; ok deraadtJason McIntyre
2019-06-29two more syscall == -1 checksTheo de Raadt
2019-06-28Specify that {v,}asprintf(3) returns precisely -1 on failure,Ingo Schwarze
and that the ret pointer is either unchanged or set to NULL in this case. Since these two functions are not standardized by POSIX, documenting the actual behaviour is the way to go, and the above matches all non-buggy implementations we are aware of. OK millert@ deraadt@
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2019-06-27Simplify the description of [v]snprintf(3), move the descriptionIngo Schwarze
of the return values to RETURN VALUES, deprecate [v]sprintf(3) and fix a punctuation typo. Joint work with and OK millert@.
2019-06-26an -> a;Jason McIntyre
2019-06-26The POSIX-compatible way of checking for {v,}{f,s,sn,d}printf(3)Theo de Raadt
failure is with < 0, not the more specific -1 from C discussed at length with millert, nicm, schwarze
2019-05-16More consistently put remarks about the less useful LC_* categoties,Ingo Schwarze
i.e. those other than LC_CTYPE, into the CAVEATS section, and standardize wording somewhat. OK jmc@
2019-05-02Fix a comparison in open_memstream not to confuse when a negativeYASUOKA Masahiko
value is given for the off. found by nagasaka at IIJ. ok deraadt
2019-04-26Undo changes to tmpfile.c r1.5.Martijn van Duren
Doing the fchown call causes pledge("tmppath") to be insufficient and the the umask dance may cause race-conditions in multithreaded applications. Also POSIX states the following nowadays: implementations may restrict the permissions, either by clearing the file mode bits or setting them to the value S_IRUSR | S_IWUSR. Encouraging words from tedu@ Standards verification and OK millert@
2019-03-03in vdprintf(), no need to use the file locking mecanism when usingSebastien Marie
fflush() as the variable is stack based (no possible concurrent access). call directly __sflush() ok visa@ deraadt@
2019-01-25I am retiring my old email address; replace it with my OpenBSD one.Todd C. Miller
2019-01-16For all functions known to be infected by LC_NUMERIC, add shortIngo Schwarze
CAVEATS pointing to the new CAVEATS section in setlocale(3). Make those in wprintf(3) and wscanf(3) more concise since duplicate information is a bad idea. Incompleteness of information originally pointed out by millert@. OK millert@
2019-01-11Similar CAVEATS regarding LC_NUMERIC as was just committedIngo Schwarze
to wprintf(3) with OK cheloha@ tedu@; also triggered by a smaller diff from Jan Stary <hans at stare dot cz>.
2019-01-11Clarify that OpenBSD ignores the dangerous category LC_NUMERIC,Ingo Schwarze
and explain best practice for portable programs below CAVEATS. Triggered by a smaller diff from Jan Stary <hans at stare dot cz>. Emphatic OKs from cheloha@ and tedu@.
2018-12-16Restore the optimization for unbuffered I/O. The buffer needs toTodd C. Miller
be reset before each call to __srefill(). Passes new regress. OK semarie@
2018-12-16Back out rev 1.17 for now, it causes issues with python when buildingTodd C. Miller
databases/tdb from ports.
2018-12-14Revisit the optimization for unbuffered I/O. We can use the bufferTodd C. Miller
passed to fread(3) directly in the FILE * and call __srefill() in a loop without the memcpy(). This preserves the expected behavior in all cases. OK semarie@, "This is neat" tedu@
2018-12-14Back out the optimization in rev 1.13, it does not update flags onTodd C. Miller
EOF or error. This caused a regression in the cPickle python extension.
2018-01-02some grammar fixes; from dholland@netbsd, -r1.68Jason McIntyre
2017-12-08Fix the return value of fwscanf(3) when encountering an early matchingKevin Lo
failure. This change brings fwscanf(3) back in line with fscanf(3). From FreeBSD; ok deraadt@, millert@
2017-12-01Consistently .Xr the corresponding wide char functions from char- andIngo Schwarze
string-handling <stdio.h> functions, like we already do it for <string.h>. Includes a smaller patch from <kshe59 at zoho dot eu>, OK jmc@.
2017-12-01add missing argument name; from <kshe59 at zoho dot eu>; OK jmc@;Ingo Schwarze
while here, consistently use .Fo to cure execessive line lengths
2017-11-28GNU ld has prefixed the contents of .gnu.warning.SYMBOL sectionsTheo Buehler
with "warning: " since 2003, so the messages themselves need not contain the prefix anymore. From Scott Cheloha ok jca, deraadt
2017-11-21Use a simple forward search to find '%' in the format string instead ofTheo Buehler
using mbrtowc(3). Thus, we now treat the format string as a bytestring, not as a multibyte character string. We think that ANSI C made a small error when adding wide characters: The committees essentially replaced "characters" with "wide characters" in the existing printf documentation, which was written before the concept of processing was established. Doing processing on the format string would break some 8-bit format strings in the wild, and that isn't something these committees gave themselves license to do. Based on the "10x printf speedup" commit from android found by tedu: https://github.com/aosp-mirror/platform_bionic/commit/5305a4d4a723b06494b93f2df81733b83a0c46d3 Thanks to millert and schwarze for digging into the history and testing *printf behavior on other platforms. ok deraadt, millert
2017-11-16Add error checking to some calls to __find_arguments(). Matches similarTheo Buehler
changes by schwarze to vfprintf.c r1.71. Cherrypicked from android: https://github.com/aosp-mirror/platform_bionic/commit/5305a4d4a723b06494b93f2df81733b83a0c46d3 ok millert
2017-10-17add missing HISTORY; based on CVS logs and release announcementsIngo Schwarze
2017-08-15fmt0 is a wchar_t *, so use %ls to reportTheo de Raadt
2017-07-22Favor err() over perror() in example.anton
ok schwarze@
2017-07-041. mild deprecation noticeIngo Schwarze
2. point to getline (suggested by nicm@) 3. cross reference fgetc(3) rather than putc(3) 4. add missing error handling to the example code OK nicm@
2017-06-12Add dprintf() and vdprintf() RETURN VALUES. OK deraadt@Todd C. Miller
2017-04-13Use recallocarray in getdelim/getline to clear memory on buffer resizes,Bryan Steele
inspired by a similar change to fgetln. ok deraadt millert
2017-03-17Use recallocarray() to avoid leaving detritus in memory when resizingTodd C. Miller
the string buffer used by asprintf() and vasprintf(). OK deraadt@
2017-03-17Use recallocarray() to avoid leaving detritus in memory when resizingTheo de Raadt
buffers. We don't bother doing this for objects containing pointers, but focus on controllable data. ok millert
2017-03-16Only reallocate the buffer to fit for medium-size allocations whereTodd C. Miller
we expanded the buffer to a single page. The final realloc() can be expensive for large buffers and is not realled needed. OK deraadt@
2017-03-16When reallocating the buffer for asprintf(), just round up to theTodd C. Miller
nearest page instead of doubling the old size until it is large enough. OK deraadt@
2017-03-14Use a macro for the initial length of the buffer instead of 127; OK deraadt@Todd C. Miller
2016-10-30include float.h for the LDBL_MAX_EXP cpp test in floatio.hJonathan Gray
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 12:10:35 +0000