This is an automated email from the ASF dual-hosted git repository.
xiaoxiang781216 pushed a commit to branch releases/13.1
in repository https://gitbox.apache.org/repos/asf/nuttx.git
The following commit(s) were added to refs/heads/releases/13.1 by this push:
new 552a90a4d92 libc/stdio: allocate a buffer in getdelim() when *lineptr
is NULL
552a90a4d92 is described below
commit 552a90a4d927aa53c773435764e67f1955cfec51
Author: Xiang Xiao <[email protected]>
AuthorDate: Sat Jul 25 00:08:37 2026 +0800
libc/stdio: allocate a buffer in getdelim() when *lineptr is NULL
POSIX requires getdelim()/getline() to allocate a new buffer whenever
*lineptr is NULL, regardless of the value of *n. The previous code read
the buffer size from *n unconditionally and only fell back to the initial
size when *n was zero, so a caller that passes *lineptr == NULL together
with an uninitialized (non-zero) *n caused lib_malloc() to be invoked with
that garbage size and typically fail with ENOMEM.
Treat a NULL *lineptr the same as a zero *n: (re)allocate from the known
BUFSIZE_INIT and ignore the untrusted *n. This matches the glibc
behaviour that portable code relies on (for example toybox grep, which
calls getdelim() with an uninitialized size variable).
Signed-off-by: Xiang Xiao <[email protected]>
---
libs/libc/stdio/lib_getdelim.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/libs/libc/stdio/lib_getdelim.c b/libs/libc/stdio/lib_getdelim.c
index 3eaed14caa3..1df381c231c 100644
--- a/libs/libc/stdio/lib_getdelim.c
+++ b/libs/libc/stdio/lib_getdelim.c
@@ -99,10 +99,14 @@ ssize_t getdelim(FAR char **lineptr, size_t *n, int
delimiter,
goto errout;
}
- /* Verify the buffer size */
+ /* Verify the buffer size. POSIX requires that a NULL *lineptr be
+ * (re)allocated regardless of the value of *n, so do not trust *n when
+ * there is no buffer: a caller may legitimately pass *lineptr == NULL with
+ * an uninitialized *n.
+ */
bufsize = *n;
- if (bufsize == 0)
+ if (*lineptr == NULL || bufsize == 0)
{
/* Pick an initial buffer size */
