[libc++] Fix segmentation fault in __do_put_integral

[MarcoFalke]

Summary

6 chars are not sufficient to represent all formats for 64 bit integers.

This was accidentally introduced in commit b889cbf36635a302f5b77560f1769178f196c2c7 (https://reviews.llvm.org/D112830).

This causes failures in downstream projects, for example:

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40817
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40841

[• Quuxplusone]

Can we add a regression test in libcxx/test/std/ for this?

[MarcoFalke]

There are tests, but the issue (segmentation fault) is only observable on 32-bit AFAICT. On other platforms it is "only" UB, but doing the right thing.

[ldionne]

Thanks for fixing this.

libcxx/include/locale

 template <class _Integral>
 _LIBCPP_HIDE_FROM_ABI inline
 _OutputIterator
 num_put<_CharT, _OutputIterator>::__do_put_integral(iter_type __s, ios_base& __iob,
                                                     char_type __fl, _Integral __v,
                                                     char const* __len) const
 {
     // Stage 1 - Get number in narrow char
-    char __fmt[6] = {'%', 0};
+    char __fmt[8] = {'%', 0};
     this->__format_int(__fmt+1, __len, is_signed<_Integral>::value, __iob.flags());
     // Worst case is octal, with showbase enabled. Note that octal is always
     // printed as an unsigned value.
     using _Unsigned = typename make_unsigned<_Integral>::type;
     _LIBCPP_CONSTEXPR const unsigned __nbuf
         = (numeric_limits<_Unsigned>::digits / 3)        // 1 char per 3 bits
         + ((numeric_limits<_Unsigned>::digits % 3) != 0) // round up
         + 2; // base prefix + terminating null character