From e2341d08fa4a4e0c22056c410fd34d3f93e06017 Mon Sep 17 00:00:00 2001
From: Elliott Hughes <enh@google.com>
Date: Fri, 2 May 2014 18:16:32 -0700
Subject: [PATCH] Disable %n in printf and vfwprintf.

Bug: 14492135
Change-Id: If190bede29e5f68a65043ddbe8e878c660933d03
---
 libc/stdio/local.h                               |  1 +
 libc/upstream-openbsd/lib/libc/stdio/vfprintf.c  |  6 +++++-
 libc/upstream-openbsd/lib/libc/stdio/vfwprintf.c |  6 +++++-
 tests/stdio_test.cpp                             | 13 +++++++++----
 4 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/libc/stdio/local.h b/libc/stdio/local.h
index 5fb22924c..907fd2160 100644
--- a/libc/stdio/local.h
+++ b/libc/stdio/local.h
@@ -102,6 +102,7 @@ extern int __sdidinit;
 #define FLOATING_POINT
 #define PRINTF_WIDE_CHAR
 #define SCANF_WIDE_CHAR
+#define NO_PRINTF_PERCENT_N
 
 /* OpenBSD exposes these in <stdio.h>, but we only want them exposed to the implementation. */
 __BEGIN_DECLS
diff --git a/libc/upstream-openbsd/lib/libc/stdio/vfprintf.c b/libc/upstream-openbsd/lib/libc/stdio/vfprintf.c
index 86b540e92..7f8ff3177 100644
--- a/libc/upstream-openbsd/lib/libc/stdio/vfprintf.c
+++ b/libc/upstream-openbsd/lib/libc/stdio/vfprintf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfprintf.c,v 1.65 2014/03/19 05:17:01 guenther Exp $	*/
+/*	$OpenBSD: vfprintf.c,v 1.66 2014/05/03 12:36:45 deraadt Exp $	*/
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
  * All rights reserved.
@@ -801,6 +801,7 @@ fp_common:
 			}
 			break;
 #endif /* FLOATING_POINT */
+#ifndef NO_PRINTF_PERCENT_N
 		case 'n':
 			if (flags & LLONGINT)
 				*GETARG(long long *) = ret;
@@ -819,6 +820,7 @@ fp_common:
 			else
 				*GETARG(int *) = ret;
 			continue;	/* no output */
+#endif /* NO_PRINTF_PERCENT_N */
 		case 'O':
 			flags |= LONGINT;
 			/*FALLTHROUGH*/
@@ -1317,6 +1319,7 @@ reswitch:	switch (ch) {
 				ADDTYPE(T_DOUBLE);
 			break;
 #endif /* FLOATING_POINT */
+#ifndef NO_PRINTF_PERCENT_N
 		case 'n':
 			if (flags & LLONGINT)
 				ADDTYPE(TP_LLONG);
@@ -1333,6 +1336,7 @@ reswitch:	switch (ch) {
 			else
 				ADDTYPE(TP_INT);
 			continue;	/* no output */
+#endif /* NO_PRINTF_PERCENT_N */
 		case 'O':
 			flags |= LONGINT;
 			/*FALLTHROUGH*/
diff --git a/libc/upstream-openbsd/lib/libc/stdio/vfwprintf.c b/libc/upstream-openbsd/lib/libc/stdio/vfwprintf.c
index 7cb08eabb..745b4d93f 100644
--- a/libc/upstream-openbsd/lib/libc/stdio/vfwprintf.c
+++ b/libc/upstream-openbsd/lib/libc/stdio/vfwprintf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vfwprintf.c,v 1.9 2014/03/19 05:17:01 guenther Exp $ */
+/*	$OpenBSD: vfwprintf.c,v 1.10 2014/05/03 12:36:45 deraadt Exp $ */
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
  * All rights reserved.
@@ -784,6 +784,7 @@ fp_common:
 			}
 			break;
 #endif /* FLOATING_POINT */
+#ifndef NO_PRINTF_PERCENT_N
 		case 'n':
 			if (flags & LLONGINT)
 				*GETARG(long long *) = ret;
@@ -802,6 +803,7 @@ fp_common:
 			else
 				*GETARG(int *) = ret;
 			continue;	/* no output */
+#endif /* NO_PRINTF_PERCENT_N */
 		case 'O':
 			flags |= LONGINT;
 			/*FALLTHROUGH*/
@@ -1296,6 +1298,7 @@ reswitch:	switch (ch) {
 				ADDTYPE(T_DOUBLE);
 			break;
 #endif /* FLOATING_POINT */
+#ifndef NO_PRINTF_PERCENT_N
 		case 'n':
 			if (flags & LLONGINT)
 				ADDTYPE(TP_LLONG);
@@ -1312,6 +1315,7 @@ reswitch:	switch (ch) {
 			else
 				ADDTYPE(TP_INT);
 			continue;	/* no output */
+#endif /* NO_PRINTF_PERCENT_N */
 		case 'O':
 			flags |= LONGINT;
 			/*FALLTHROUGH*/
diff --git a/tests/stdio_test.cpp b/tests/stdio_test.cpp
index d825c14ec..44ad76d80 100644
--- a/tests/stdio_test.cpp
+++ b/tests/stdio_test.cpp
@@ -220,11 +220,16 @@ TEST(stdio, snprintf_ls) {
 }
 
 TEST(stdio, snprintf_n) {
+#if !defined(__GLIBC__)
+  // http://b/14492135
   char buf[32];
-  int i = 0;
-  EXPECT_EQ(4, snprintf(buf, sizeof(buf), "a %n b", &i));
-  EXPECT_EQ(2, i);
-  EXPECT_STREQ("a  b", buf);
+  int i = 1234;
+  EXPECT_EQ(5, snprintf(buf, sizeof(buf), "a %n b", &i));
+  EXPECT_EQ(1234, i);
+  EXPECT_STREQ("a n b", buf);
+#else
+  GTEST_LOG_(INFO) << "This test does nothing.\n";
+#endif
 }
 
 TEST(stdio, snprintf_smoke) {