Re: bug in __gmp_replacement_vsnprintf

[Vincent Lefevre]

On 2023-08-21 10:59:13 +0200, Paul Zimmermann wrote:
> here is a small program that exhibits the bug (for example on gcc231):
[...]

An OpenBSD 7 machine, and this is due to the fact that %n is
no longer supported by the system *printf functions, so that
GMP uses __gmp_replacement_vsnprintf.

See also in the archives:

https://gmplib.org/list-archives/gmp-bugs/2022-October/005200.html
https://gmplib.org/list-archives/gmp-bugs/2023-January/005230.html

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
___
gmp-bugs mailing list
gmp-bugs@gmplib.org
https://gmplib.org/mailman/listinfo/gmp-bugs

bug in __gmp_replacement_vsnprintf

[Paul Zimmermann]

   Hi,

here is a small program that exhibits the bug (for example on gcc231):

gcc231$ cat bug.c
#include 
#include 
#include 

static void
foo (char **buf, const char *fmt, ...)
{
  va_list ap;
  va_start (ap, fmt);
  gmp_vasprintf (buf, fmt, ap);
  va_end (ap);
}

int
main (int argc, char **argv)
{
  char *buf[1];
  foo (buf, "%a", -1.25);
  printf ("buf='%s'\n", buf[0]);
}

gcc231$ cc -I. bug.c .libs/libgmp.a   
.libs/libgmp.a(doprntf.o): In function `__gmp_doprnt_mpf2':
doprntf.c:(.text+0x2c4): warning: sprintf() is often misused, please use 
snprintf()
.libs/libgmp.a(repl-vsnprintf.o): In function `__gmp_replacement_vsnprintf':
repl-vsnprintf.c:(.text+0x3a8): warning: vsprintf() is often misused, please 
use vsnprintf()

gcc231$ ./a.out   
repl-vsnprintf.c:389: GNU MP assertion failed: len < total_width
Abort trap (core dumped) 

You can also reproduce on any other computer after uncommenting
#define HAVE_VSNPRINTF 1 in config.h.

Paul

PS: it would be nice to add some tests with %a or %A in tests/misc/t-printf.c
___
gmp-bugs mailing list
gmp-bugs@gmplib.org
https://gmplib.org/mailman/listinfo/gmp-bugs

bug in __gmp_replacement_vsnprintf

[Paul Zimmermann]

ping:

https://gmplib.org/list-archives/gmp-bugs/2022-October/005200.html

The bug was acknowledged by Niels in January:

https://gmplib.org/list-archives/gmp-bugs/2023-January/005230.html

but not fixed in 6.3.0.

Paul
___
gmp-bugs mailing list
gmp-bugs@gmplib.org
https://gmplib.org/mailman/listinfo/gmp-bugs

Re: bug in __gmp_replacement_vsnprintf

[Niels Möller]

Paul Zimmermann  writes:

> this bug report got no feedback so far:
>
> https://gmplib.org/list-archives/gmp-bugs/2022-October/005200.html
>
> Do the GMP developers acknowledge it?

I'm not so familiar with this part of GMP, but it looks like a bug to
me.

I would suggest first changing the ASSERT at
https://gmplib.org/repo/gmp/file/tip/printf/repl-vsnprintf.c#l355 to
ASSERT_ALWAYS; it seems rather dangerous to pass format specifiers we're
not understanding to the system's vsprintf. And to really fix this
issue, we'd also have to actually support hex floats with %a and %A.

Looks like the file was written by Kevin Ryde two decades ago. I wonder
if it's possible/reasonable to replace with gnulib's version? That's a
few thousand lines of rather non-trivial code, though:
https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=blob;f=lib/vasnprintf.c;h=ab11ad026ed1b5d224dd71a8c880a30d859339cb;hb=HEAD

Regards,
/Niels

-- 
Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677.
Internet email is subject to wholesale government surveillance.
___
gmp-bugs mailing list
gmp-bugs@gmplib.org
https://gmplib.org/mailman/listinfo/gmp-bugs

bug in __gmp_replacement_vsnprintf

[Paul Zimmermann]

   Hi,

this bug report got no feedback so far:

https://gmplib.org/list-archives/gmp-bugs/2022-October/005200.html

Do the GMP developers acknowledge it?

Best regards,
Paul
___
gmp-bugs mailing list
gmp-bugs@gmplib.org
https://gmplib.org/mailman/listinfo/gmp-bugs

bug in __gmp_replacement_vsnprintf

[Paul Zimmermann]

   Hi,

[for the record, this issue was originally reported on the MPFR list:
https://sympa.inria.fr/sympa/arc/mpfr/2022-10/msg1.html]

Originally, it appeared only under Windows with the clang compiler,
and using MPIR, but I can reproduce it under Linux with GMP 6.2.1:

1) configure GMP
2) uncomment the #define HAVE_VSNPRINTF 1 line in config.h
3) build GMP
4) run the MPFR tsprintf test file with the built GMP

The issue is because __gmp_replacement_vsnprintf does not deal with %a not %A.
Then when calling gmp_printf ("%a", -1.25) for example, we get total_width=3
initially, we jump to the 'default' case, where the ASSERT(0) does nothing
in production code, and we go to next, where width=0 and prec=6, thus
total_width is increased to 9. But we also have len=9 because
buf='-0x1.4p+0'. Then the assertion ASSERT_ALWAYS (len < total_width) fails.

Paul

___
gmp-bugs mailing list
gmp-bugs@gmplib.org
https://gmplib.org/mailman/listinfo/gmp-bugs