[PATCH] stdio-impl.h: Fix type of _offset field for Android

[PATCH] stdio-impl.h: Fix type of _offset field for Android

[Tee KOBAYASHI]

On 32-bit Android fpos_t becomes a 64-bit type when large-file support
is enabled, whereas _offset remains 32-bit. Out-of-bounds read/write
could happen when _offset field is accessed in this situation.
---
 lib/stdio-impl.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/stdio-impl.h b/lib/stdio-impl.h
index ed32e69..1384b8e 100644
--- a/lib/stdio-impl.h
+++ b/lib/stdio-impl.h
@@ -68,8 +68,10 @@
 # elif defined __ANDROID__ /* Android */
 #  ifdef __LP64__
 #   define _gl_flags_file_t int
+#   define _gl_struct_file_off_t int64_t
 #  else
 #   define _gl_flags_file_t short
+#   define _gl_struct_file_off_t __kernel_off_t
 #  endif
   /* Up to this commit from 2015-10-12
      <https://android.googlesource.com/platform/bionic.git/+/f0141dfab10a4b332769d52fa76631a64741297a>
@@ -96,7 +98,7 @@
                          unsigned char _nbuf[1]; \
                          struct { unsigned char *_base; size_t _size; } _lb; \
                          int _blksize; \
-                         fpos_t _offset; \
+                         _gl_struct_file_off_t _offset; \
                          /* More fields, not relevant here.  */ \
                        } *) fp)
 # else
--
2.36.1

Re: [PATCH] stdio-impl.h: Fix type of _offset field for Android

[Paul Eggert]

On 9/28/22 17:51, Tee KOBAYASHI wrote:
> On 32-bit Android fpos_t becomes a 64-bit type when large-file support
> is enabled, whereas _offset remains 32-bit. Out-of-bounds read/write
> could happen when _offset field is accessed in this situation.

Thanks for the bug report, but does this actually fix the bug? In recent 
Android, _offset is documented to not work; 
android/platform_bionic/libc/stdio/local.h line 101 says "fpos_t 
_unused_0;  // This was the `_offset` field (see below)."

There is a similar issue with DragonFly's _offset field.

Re: [PATCH] stdio-impl.h: Fix type of _offset field for Android

[Henrik Grimler]

Hi Paul,

(re-send with list in cc)

It at least seem to fix these three bugs:

https://github.com/termux/termux-packages/issues/7361
https://github.com/termux/termux-packages/issues/9056
https://github.com/termux/termux-packages/issues/11912

when compiling with API level 24 compability (i.e. android 7).

Best regards,
Henrik Grimler