#include #include int main() { const struct { const char *locale; const char *expected; } tests[] = { { "C", "[**1234.57] [**1234.57]" }, { "de_DE.UTF-8", "[ **1234,57 €] [ **1.234,57 EUR ]" }, { "en_GB.UTF-8", "[ £**1234.57] [ GBP **1,234.57]" }, }; locale_t loc; size_t i; char buf[80]; for (i = 0; i < __arraycount(tests); ++i) { loc = newlocale(LC_MONETARY_MASK, tests[i].locale, 0); strfmon_l(buf, sizeof(buf), loc, "[%^=*#6n] [%=*#6i]", 1234.567, 1234.567); freelocale(loc); } return 0; } /* $ ./a.out ================================================================= ==20639==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000ef33 at pc 0x7f7ff6c3053e bp 0x7f7fffffe4f0 sp 0x7f7fffffdca0 READ of size 11 at 0x60300000ef33 thread T0 #0 0x7f7ff6c3053d in __asan_memmove (/usr/lib/libasan.so.2+0x3053d) #1 0x7f7ff68441f6 in __memmove_ichk /usr/include/ssp/string.h:83 #2 0x7f7ff68441f6 in __format_grouped_double /usr/src/lib/libc/stdlib/strfmon.c:619 #3 0x7f7ff6844578 in vstrfmon_l /usr/src/lib/libc/stdlib/strfmon.c:270 #4 0x7f7ff6844b94 in strfmon_l /usr/src/lib/libc/stdlib/strfmon.c:646 #5 0x400cc3 in main (/usr/src/tests/lib/libc/locale/a.out+0x400cc3) #6 0x400a5a in ___start (/usr/src/tests/lib/libc/locale/a.out+0x400a5a) 0x60300000ef33 is located 0 bytes to the right of 19-byte region [0x60300000ef20,0x60300000ef33) allocated by thread T0 here: #0 0x7f7ff6c15e6c in __interceptor_malloc (/usr/lib/libasan.so.2+0x15e6c) #1 0x7f7ff6844017 in __format_grouped_double /usr/src/lib/libc/stdlib/strfmon.c:555 SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memmove Shadow bytes around the buggy address: 0x0c067fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c067fff9de0: fa fa fa fa 00 00[03]fa fa fa 00 00 00 00 fa fa 0x0c067fff9df0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 0x0c067fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c067fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==20639==ABORTING */