[Bug 3037] New: scanf handles %p as an integer, truncated value on 64bits platforms

bugzilla at busybox.net bugzilla at busybox.net
Fri Dec 31 10:38:45 UTC 2010


https://bugs.busybox.net/show_bug.cgi?id=3037

           Summary: scanf handles %p as an integer, truncated value on
                    64bits platforms
           Product: uClibc
           Version: 0.9.32
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: stdio
        AssignedTo: unassigned at uclibc.org
        ReportedBy: eric.hassold at gmail.com
                CC: uclibc-cvs at uclibc.org
   Estimated Hours: 0.0


Created attachment 2827
  --> https://bugs.busybox.net/attachment.cgi?id=2827
patch for scanf to handle %p as long on 64bits platforms

When scanning %p conversion, sscanf stores value as an unsigned integer. On
64bits platforms (e.g. x86_64), this causes returned pointers to be invalid
since high-word is lost. Test to reproduce:

     #include <stdio.h>
     #define PREFIX "ZZZZZ"

     int main (int qrgc, char **argv) {
       void *p = (void*) 0x1122334455667788;
       char *s = PREFIX "0xABCD00004321";
       sscanf(s,PREFIX"%p",&p);
       printf("scanned '%s', got %p\n",s,p);
       return 0;
     }

This was observed with latest snapshot from master branch, but since code in
_sscanf.c hasn't been modified since 2009, bug should exist in several prior
releases (while affecting only 64bits platforms).

To work around this, I modified QUAL_CHARS so %p conversion uses PDS value
(like %t modifier) when calling store_inttype(). Patch attached.

-- 
Configure bugmail: https://bugs.busybox.net/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


More information about the uClibc-cvs mailing list