Hi Jeff, On Tue, 28 Jan 2014 11:24:05 -0600, Jeff Epler <[email protected]> wrote: > The following program crashes when built with x86_64-w64-mingw32-g++ or > i686-w64-mingw32-g++: > > #include <iostream> > > int main() { > std::cout.setf(std::ios::fixed); > std::cout << 1e300 << "\n"; > return 0; > } > > > The underlying cause is an assumption that snprintf never returns -1. In > fact, on Windows, the platform snprintf returns -1 when the buffer is not > big enough, which leads to (A) calling alloca(-1) and (B) calling std::widen > with fin < st, either one of which is probably enough to lead to a > crash. > > The patch shown below fixes several locations in libstdc++ where a > negative return value from snprintf was not properly handled. > > As far as I'm aware, this bug also exists upstream, but I have not filed > it there.
Thanks for the detailed bug report and patch! I've confirmed the issue occurs on gcc-mingw-w64 4.6.3 and 4.6.4, but it's fixed in the Debian packages of 4.8.2, apparently thanks to a MinGW-w64-provided implementation of vsnprintf which is used instead of the platform version now. I've forwarded the bug upstream, it's at http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59974 Regards, Stephen
signature.asc
Description: PGP signature
