When `money_get::do_get` analyzes a large value, inner code `malloc`s enough buffer, but `sscanf` doesn't get number from `malloc`ed buf

[ZLFooler]

llvm-project/libcxx/include/locale

Lines 2580 to 2615 in 737d6ca

	template <class _CharT, class _InputIterator>
	_InputIterator money_get<_CharT, _InputIterator>::do_get(
	iter_type __b, iter_type __e, bool __intl, ios_base& __iob, ios_base::iostate& __err, long double& __v) const {
	const int __bz = 100;
	char_type __wbuf[__bz];
	unique_ptr<char_type, void (*)(void*)> __wb(__wbuf, __do_nothing);
	char_type* __wn;
	char_type* __we = __wbuf + __bz;
	locale __loc = __iob.getloc();
	const ctype<char_type>& __ct = std::use_facet<ctype<char_type> >(__loc);
	bool __neg = false;
	if (__do_get(__b, __e, __intl, __loc, __iob.flags(), __err, __neg, __ct, __wb, __wn, __we)) {
	const char __src[] = "0123456789";
	char_type __atoms[sizeof(__src) - 1];
	__ct.widen(__src, __src + (sizeof(__src) - 1), __atoms);
	char __nbuf[__bz];
	char* __nc = __nbuf;
	unique_ptr<char, void (*)(void*)> __h(nullptr, free);
	if (__wn - __wb.get() > __bz - 2) {
	__h.reset((char*)malloc(static_cast<size_t>(__wn - __wb.get() + 2)));
	if (__h.get() == nullptr)
	__throw_bad_alloc();
	__nc = __h.get();
	}
	if (__neg)
	*__nc++ = '-';
	for (const char_type* __w = __wb.get(); __w < __wn; ++__w, ++__nc)
	*__nc = __src[std::find(__atoms, std::end(__atoms), *__w) - __atoms];
	*__nc = char();
	if (sscanf(__nbuf, "%Lf", &__v) != 1)
	__throw_runtime_error("money_get error");
	}
	if (__b == __e)
	__err |= ios_base::eofbit;
	return __b;
	}

When if (__wn - __wb.get() > __bz - 2) is true, __nc will change point from _nbuf to __h. The result will fill in __nc(__h), but sscanf(__nbuf, "%Lf", &__v) only get value from _nbuf. In this case, code can not get right value from __h.

[frederick-vs-ja]

Reproducible example (Godbolt link):

#include <string>
#include <sstream>
#include <iostream>
#include <locale>

using Fn = std::money_get<char, const char*>;

class my_facet : public Fn {
public:
    my_facet() : my_facet(0) {}
    explicit my_facet(std::size_t refs) : Fn(refs) {}
};

int main()
{
    {
        std::ios_base::iostate ec{};
        long double x{};

        std::string s = "5";
        for (int i = 0; i != 256; ++i) {
            if (i == 95)
                s.push_back('.');
            s.push_back(static_cast<char>(i % 10 + '0'));
        }
        std::istringstream is;

        my_facet{}.get(s.data(), s.data() + s.size(), false, is, ec, x); // OK
        std::cout << x << '\n';
    }
    {
        std::ios_base::iostate ec{};
        long double x{};

        std::string s = "5";
        for (int i = 0; i != 256; ++i) {
            if (i == 105)
                s.push_back('.');
            s.push_back(static_cast<char>(i % 10 + '0'));
        }
        std::istringstream is;

        my_facet{}.get(s.data(), s.data() + s.size(), false, is, ec, x); // bad
        std::cout << x << '\n';
    }
}

[frederick-vs-ja]

Thanks! I've edited the title and description for readability.

[philnik777]

Out of curiosity, how did you find this? Are you actually using money_get? I've looked into optimizing the locale facilities recently, but couldn't find much usage of money_get outside standard library tests.