https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118099
--- Comment #4 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Jonathan Wakely <[email protected]>: https://gcc.gnu.org/g:2d296e9f024edbb49cad1f3ebb5ae34c71ea5f7a commit r17-5970-g2d296e9f024edbb49cad1f3ebb5ae34c71ea5f7a Author: Jonathan Wakely <[email protected]> Date: Wed Oct 28 10:34:17 2026 +0000 libstdc++: Fix buffer overflows in basic_filebuf::overflow [PR118099] If we fail to write the content of the buffer after inserting the overflow character into the end of it, then remove that overflow character before propagating the error back to the caller. Without this, the caller is left with pptr set past epptr, and successive calls to overflow will write further past the end of the managed buffer with each failure. The new 118099-codecvt.cc tests were assisted by an LLM because I was too lazy to remember how to write codecvt facets. Assisted-by: LLM libstdc++-v3/ChangeLog: PR libstdc++/118099 * include/bits/fstream.tcc (basic_filebuf::overflow): Rewind the put position if outputting the put area fails. * testsuite/27_io/basic_filebuf/overflow/char/118099-codecvt.cc: New test. * testsuite/27_io/basic_filebuf/overflow/char/118099.cc: New test. * testsuite/27_io/basic_filebuf/overflow/wchar_t/118099-codecvt.cc: New test. * testsuite/27_io/basic_filebuf/overflow/wchar_t/118099.cc: New test. Reviewed-by: Tomasz KamiÅski <[email protected]>
