[libc-commits] [PATCH] D106885: [libc] Fix strtok_r crash when src and *saveptr are both nullptr

[Alf via Phabricator via libc-commits]

gAlfonso-bit created this revision.
gAlfonso-bit added reviewers: LLVM, libc-project.
gAlfonso-bit added projects: LLVM, libc-project.
Herald added subscribers: libc-commits, ecnelises, tschuett.
gAlfonso-bit requested review of this revision.

While working and testing my refactoring of multiple string functions in libc, I came across a bug that needs to be addressed in a patch on its own: src is checked for nullptr and assigned to *saveptr if it is nullptr. However, saveptr is initially nullptr when it comes to reentry. This could cause a problem if both saveptr and src are null; we need to do the check first and return nullptr if both are nullptr.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D106885

Files:
  libc/src/string/string_utils.h


Index: libc/src/string/string_utils.h
===================================================================
--- libc/src/string/string_utils.h
+++ libc/src/string/string_utils.h
@@ -58,23 +58,26 @@
 static inline char *string_token(char *__restrict src,
                                  const char *__restrict delimiter_string,
                                  char **__restrict saveptr) {
+  // Check for nullptr in src AND *saveptr first
+  if (src == nullptr && ((src = *saveptr) == nullptr))
+    return nullptr;
+
   cpp::Bitset<256> delimiter_set;
-  for (; *delimiter_string; ++delimiter_string)
+  for (; *delimiter_string != '\0'; ++delimiter_string)
     delimiter_set.set(*delimiter_string);
 
-  src = src ? src : *saveptr;
-  for (; *src && delimiter_set.test(*src); ++src)
+  for (; *src != '\0' && delimiter_set.test(*src); ++src)
     ;
-  if (!*src) {
+  if (*src == '\0') {
     *saveptr = src;
     return nullptr;
   }
   char *token = src;
-  for (; *src && !delimiter_set.test(*src); ++src)
-    ;
-  if (*src) {
-    *src = '\0';
-    ++src;
+  for (; *src != '\0'; ++src) {
+    if (delimiter_set.test(*src)) {
+      *src++ = '\0';
+      break;
+    }
   }
   *saveptr = src;
   return token;


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D106885.362044.patch
Type: text/x-patch
Size: 1219 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/libc-commits/attachments/20210727/df6d7787/attachment.bin>