[libcxx-commits] [PATCH] D146294: [libcxx] Fix crash in std::stringstream with payload >= INT_MAX

[Nikolas Klauser via Phabricator via libcxx-commits]

This revision was automatically updated to reflect the committed changes.
Closed by commit rG53aed4759b33: [libcxx] Fix crash in std::stringstream with payload >= INT_MAX (authored by azat, committed by philnik).

Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D146294/new/

https://reviews.llvm.org/D146294

Files:
  libcxx/include/sstream
  libcxx/test/std/input.output/string.streams/stringstream.members/gcount.pass.cpp


Index: libcxx/test/std/input.output/string.streams/stringstream.members/gcount.pass.cpp
===================================================================
--- /dev/null
+++ libcxx/test/std/input.output/string.streams/stringstream.members/gcount.pass.cpp
@@ -0,0 +1,41 @@
+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// All 32 bit arches that CI has:
+//
+// UNSUPPORTED: target=powerpc-ibm-aix
+// UNSUPPORTED: target=armv7l-linux-gnueabihf
+// UNSUPPORTED: target=armv8l-linux-gnueabihf
+// UNSUPPORTED: target=i686-w64-windows-gnu
+
+// Test that tellp() does not break the stringstream after INT_MAX, due to use
+// of pbump() that accept int.
+
+#include <cassert>
+#include <climits>
+#include <sstream>
+#include <string>
+
+int main(int, char**) {
+  std::stringstream ss;
+  std::string payload(INT_MAX - 1, '\0');
+
+  ss.write(payload.data(), payload.size());
+  assert(ss.tellp() == INT_MAX - 1);
+
+  ss.write("a", 1);
+  assert(ss.tellp() == INT_MAX);
+
+  ss.write("b", 1);
+  assert(ss.tellp() == INT_MAX + 1ULL);
+  // it fails only after previous tellp() corrupts the internal field with int
+  // overflow
+  assert(ss.tellp() == INT_MAX + 1ULL);
+
+  return 0;
+}
Index: libcxx/include/sstream
===================================================================
--- libcxx/include/sstream
+++ libcxx/include/sstream
@@ -646,7 +646,7 @@
     if (__wch & ios_base::out)
     {
         this->setp(this->pbase(), this->epptr());
-        this->pbump(__noff);
+        this->__pbump(__noff);
     }
     return pos_type(__noff);
 }


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D146294.523081.patch
Type: text/x-patch
Size: 1882 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/libcxx-commits/attachments/20230517/465532b5/attachment.bin>