I think I have found a buffer overflow bug in the VC++10 std::locale object. I would be grateful for second opinions as to whether I am doing something wrong.
The code below is simplified to demonstrate the problem. I am trying to convert a wchar_t (UTF-16) character to the (Windows) ANSI code page 51949 (a.k.a. EUC-KR). The code page was chosen because it uses double byte (DBCS) encoding.
I am deliberately supplying a single char buffer for a double byte result, expecting it to fail with a status of "partial" or "error".
Instead it is returning status "ok", writing past the end of the buffer and causing an exception for a corrupt stack when it tries to exit.
#include <iostream>
#include <locale>
#include <cwchar>
typedef std::codecvt<wchar_t, char, mbstate_t> cvt_t;
void PrintResult(cvt_t::result r)
{
switch (r)
{
case cvt_t::ok:
std::cout << "ok\n";
break;
case cvt_t::partial:
std::cout << "partial\n";
break;
case cvt_t::error:
std::cout << "error\n";
break;
case cvt_t::noconv:
std::cout << "noconv\n";
break;
}
}
int main()
{
const wchar_t src = L'안';
char dst = 0;
std::locale loc("Korean_Korea.51949");
mbstate_t state = { 0 };
const cvt_t &facet = std::use_facet<cvt_t>(loc);
cvt_t::result res;
const wchar_t *pSrc;
char *pDst;
res = facet.out(state, &src, &src+1, pSrc, &dst, &dst+1, pDst);
PrintResult(res);
return 0;
}
Stepping inside facet.out() using the debugger, I find myself (down a couple of levels) in the following function:
virtual result __CLR_OR_THIS_CALL do_out(_Statype& _State,
const _Elem *_First1, const _Elem *_Last1, const _Elem *& _Mid1,
_Byte *_First2, _Byte *_Last2, _Byte *& _Mid2) const
{ // convert [_First1, _Last1) to bytes [_First2, _Last)
_DEBUG_RANGE(_First1, _Last1);
_DEBUG_RANGE(_First2, _Last2);
_Mid1 = _First1, _Mid2 = _First2;
result _Ans = _Mid1 == _Last1 ? ok : partial;
int _Bytes;
while (_Mid1 != _Last1 && _Mid2 != _Last2)
if ((int)MB_CUR_MAX <= _Last2 - _Mid2)
if ((_Bytes = _Wcrtomb(_Mid2, *_Mid1,
&_State, &_Cvt)) < 0)
return (error); // locale-specific wcrtomb failed
else
++_Mid1, _Mid2 += _Bytes, _Ans = ok;
else
{ // destination too small, convert into buffer
_Byte _Buf[MB_LEN_MAX];
_Statype _Stsave = _State;
if ((_Bytes = _Wcrtomb(_Buf, *_Mid1,
&_State, &_Cvt)) < 0)
return (error); // locale-specific wcrtomb failed
else if (_Last2 - _Mid2 < _Bytes)
{ // converted too many, roll back and return previous
_State = _Stsave;
return (_Ans);
}
else
{ // copy converted bytes from buffer
_CSTD memcpy(_Mid2, _Buf, _Bytes);
++_Mid1, _Mid2 += _Bytes, _Ans = ok;
}
}
return (_Ans);
}
The problem seems to be this:
On the line if ((int)MB_CUR_MAX <= _Last2 - _Mid2), MB_CURR_MAX (which is #defined to a function ___mb_cur_max_func(), is returning "1", not the "2" expected for a DBCS char.
_CRTIMP int __cdecl ___mb_cur_max_func(void)
{
/*
* Note that we don't need _LocaleUpdate in this function.
* The main reason being, that this is a leaf function in
* locale usage terms.
*/
_ptiddata ptd = _getptd();
pthreadlocinfo ptloci = ptd->ptlocinfo;
__UPDATE_LOCALE(ptd, ptloci);
return ptloci->mb_cur_max;
}
This function seems to be accessing a global locale, rather than the locale that was supplied when initialising the facet.
If I set the global locale as follows:
std::locale::global(loc);
It all works OK (and fails with status "partial").
Thus it seems to me that this particular implementation of out() is incorrectly using the global locale to determine MB_CUR_MAX, instead of the locale supplied at the object's construction -- and thus causing a buffer overflow bug.
Anybody able to point out my mistake(s) in this?
------------------------------
Update 20 May 2013
------------------------------
I have reported this to MS as bug 787227.
------------------------------
Update 27 July 2015
------------------------------
I have an email from Microsoft saying that this bug is fixed in the new RTM of Visual Studio 2015. (Yay)
