1
/* Setting this macro to 1 enables the use of the _vtable_offset bias
2
   in _IO_JUMPS_FUNCS, below.  This is only needed for new-format
3
   _IO_FILE in libc that must support old binaries (see oldfileops.c).  */
4
#if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_1) && !defined _IO_USE_OLD_IO_FILE
5
# define _IO_JUMPS_OFFSET 1
6
#else
7
# define _IO_JUMPS_OFFSET 0
8
#endif

1
#if _IO_JUMPS_OFFSET
2
# define _IO_JUMPS_FUNC(THIS) \
3
  (IO_validate_vtable                                                   \
4
   (*(struct _IO_jump_t **) ((void *) &_IO_JUMPS_FILE_plus (THIS)  \
5
           + (THIS)->_vtable_offset)))
6
# define _IO_JUMPS_FUNC_UPDATE(THIS, VTABLE)        \
7
  (*(const struct _IO_jump_t **) ((void *) &_IO_JUMPS_FILE_plus (THIS)  \
8
          + (THIS)->_vtable_offset) = (VTABLE))
9
# define _IO_vtable_offset(THIS) (THIS)->_vtable_offset
10
#else
11
# define _IO_JUMPS_FUNC(THIS) (IO_validate_vtable (_IO_JUMPS_FILE_plus (THIS)))
12
# define _IO_JUMPS_FUNC_UPDATE(THIS, VTABLE) \
13
  (_IO_JUMPS_FILE_plus (THIS) = (VTABLE))
14
# define _IO_vtable_offset(THIS) 0
15
#endif

1
</div>
2
</details>
3
<details>
4
<summary>/time/localtime.c:__localtime64_r</summary>
5
<div markdown="1">
6
```c
7
/* Return the `struct tm' representation of *T in local time,
8
   using *TP to store the result.  */
9
struct tm *
10
__localtime64_r (const __time64_t *t, struct tm *tp)
11
{
12
  return __tz_convert (*t, 1, tp);
13
}

1
  /* Check for backup and repeat */
2
  if (_IO_in_backup (fp))
3
    {
4
      _IO_switch_to_main_get_area (fp);
5
      continue;
6
    }
7

8
  /* If we now want less than a buffer, underflow and repeat
9
     the copy.  Otherwise, _IO_SYSREAD directly to
10
     the user buffer. */
11
  if (fp->_IO_buf_base
12
      && want < (size_t) (fp->_IO_buf_end - fp->_IO_buf_base))
13
    {
14
      if (__underflow (fp) == EOF)
15
  break;
16

17
      continue;
18
    }
19

20
  /* These must be set before the sysread as we might longjmp out
21
     waiting for input. */
22
  _IO_setg (fp, fp->_IO_buf_base, fp->_IO_buf_base, fp->_IO_buf_base);
23
  _IO_setp (fp, fp->_IO_buf_base, fp->_IO_buf_base);
24

25
  /* Try to maintain alignment: read a whole number of blocks.  */
26
  count = want;
27
  if (fp->_IO_buf_base)
28
    {
29
      size_t block_size = fp->_IO_buf_end - fp->_IO_buf_base;
30
      if (block_size >= 128)
31
  count -= want % block_size;
32
    }
33

34
  count = _IO_SYSREAD (fp, s, count);
35
  if (count <= 0)
36
    {
37
      if (count == 0)
38
  fp->_flags |= _IO_EOF_SEEN;
39
      else
40
  fp->_flags |= _IO_ERR_SEEN;
41

42
      break;
43
    }
44

45
  s += count;
46
  want -= count;
47
  if (fp->_offset != _IO_pos_BAD)
48
    _IO_pos_adjust (fp->_offset, count);
49
}
50
}

1
</div>
2
</details>
3

4
<details>
5
<summary>libio/genops.c</summary>
6
<div markdown="1">
7
```c
8
int
9
__underflow (FILE *fp)
10
{
11
  if (_IO_vtable_offset (fp) == 0 && _IO_fwide (fp, -1) != -1)
12
    return EOF;
13

14
  if (fp->_mode == 0)
15
    _IO_fwide (fp, -1);
16
  if (_IO_in_put_mode (fp))
17
    if (_IO_switch_to_get_mode (fp) == EOF)
18
      return EOF;
19
  if (fp->_IO_read_ptr < fp->_IO_read_end)
20
    return *(unsigned char *) fp->_IO_read_ptr;
21
  if (_IO_in_backup (fp))
22
    {
23
      _IO_switch_to_main_get_area (fp);
24
      if (fp->_IO_read_ptr < fp->_IO_read_end)
25
  return *(unsigned char *) fp->_IO_read_ptr;
26
    }
27
  if (_IO_have_markers (fp))
28
    {
29
      if (save_for_backup (fp, fp->_IO_read_end))
30
  return EOF;
31
    }
32
  else if (_IO_have_backup (fp))
33
    _IO_free_backup_area (fp);
34
  return _IO_UNDERFLOW (fp);
35
}
36
libc_hidden_def (__underflow)

1
  if ((stdout->_flags & (_IO_LINKED | _IO_NO_WRITES | _IO_LINE_BUF))
2
  == (_IO_LINKED | _IO_LINE_BUF))
3
_IO_OVERFLOW (stdout, EOF);
4

5
  _IO_release_lock (stdout);
6
}

1
</div>
2
</details>
3

4
<details>
5
<summary>libio/wfileops.c:_IO_wfile_underflow</summary>
6
<div markdown="1">
7
```c
8
wint_t
9
_IO_wfile_underflow (FILE *fp)
10
{
11
  struct _IO_codecvt *cd;
12
  enum __codecvt_result status;
13
  ssize_t count;
14

15
  /* C99 requires EOF to be "sticky".  */
16
  if (fp->_flags & _IO_EOF_SEEN)
17
    return WEOF;
18

19
  if (__glibc_unlikely (fp->_flags & _IO_NO_READS))
20
    {
21
      fp->_flags |= _IO_ERR_SEEN;
22
      __set_errno (EBADF);
23
      return WEOF;
24
    }
25
  if (fp->_wide_data->_IO_read_ptr < fp->_wide_data->_IO_read_end)
26
    return *fp->_wide_data->_IO_read_ptr;
27

28
  cd = fp->_codecvt;
29

30
  /* Maybe there is something left in the external buffer.  */
31
  if (fp->_IO_read_ptr < fp->_IO_read_end)
32
    {
33
      /* There is more in the external.  Convert it.  */
34
      const char *read_stop = (const char *) fp->_IO_read_ptr;
35

36
      fp->_wide_data->_IO_last_state = fp->_wide_data->_IO_state;
37
      fp->_wide_data->_IO_read_base = fp->_wide_data->_IO_read_ptr =
38
  fp->_wide_data->_IO_buf_base;
39
      status = __libio_codecvt_in (cd, &fp->_wide_data->_IO_state,
40
           fp->_IO_read_ptr, fp->_IO_read_end,
41
           &read_stop,
42
           fp->_wide_data->_IO_read_ptr,
43
           fp->_wide_data->_IO_buf_end,
44
           &fp->_wide_data->_IO_read_end);
45

46
      fp->_IO_read_base = fp->_IO_read_ptr;
47
      fp->_IO_read_ptr = (char *) read_stop;
48

49
      /* If we managed to generate some text return the next character.  */
50
      if (fp->_wide_data->_IO_read_ptr < fp->_wide_data->_IO_read_end)
51
  return *fp->_wide_data->_IO_read_ptr;
52

53
      if (status == __codecvt_error)
54
  {
55
    __set_errno (EILSEQ);
56
    fp->_flags |= _IO_ERR_SEEN;
57
    return WEOF;
58
  }
59

60
      /* Move the remaining content of the read buffer to the beginning.  */
61
      memmove (fp->_IO_buf_base, fp->_IO_read_ptr,
62
         fp->_IO_read_end - fp->_IO_read_ptr);
63
      fp->_IO_read_end = (fp->_IO_buf_base
64
        + (fp->_IO_read_end - fp->_IO_read_ptr));
65
      fp->_IO_read_base = fp->_IO_read_ptr = fp->_IO_buf_base;
66
    }
67
  else
68
    fp->_IO_read_base = fp->_IO_read_ptr = fp->_IO_read_end =
69
      fp->_IO_buf_base;
70

71
  if (fp->_IO_buf_base == NULL)
72
    {
73
      /* Maybe we already have a push back pointer.  */
74
      if (fp->_IO_save_base != NULL)
75
  {
76
    free (fp->_IO_save_base);
77
    fp->_flags &= ~_IO_IN_BACKUP;
78
  }
79
      _IO_doallocbuf (fp);
80

81
      fp->_IO_read_base = fp->_IO_read_ptr = fp->_IO_read_end =
82
  fp->_IO_buf_base;
83
    }
84

85
  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_write_end =
86
    fp->_IO_buf_base;
87

88
  if (fp->_wide_data->_IO_buf_base == NULL)
89
    {
90
      /* Maybe we already have a push back pointer.  */
91
      if (fp->_wide_data->_IO_save_base != NULL)
92
  {
93
    free (fp->_wide_data->_IO_save_base);
94
    fp->_flags &= ~_IO_IN_BACKUP;
95
  }
96
      _IO_wdoallocbuf (fp);
97
    }
98

99
  /* FIXME This can/should be moved to genops ?? */
100
  if (fp->_flags & (_IO_LINE_BUF | _IO_UNBUFFERED))
101
    {
102
      /* We used to flush all line-buffered stream.  This really isn't
103
   required by any standard.  My recollection is that
104
   traditional Unix systems did this for stdout.  stderr better
105
   not be line buffered.  So we do just that here
106
   explicitly.  --drepper */
107
      _IO_acquire_lock (stdout);
108

109
      if ((stdout->_flags & (_IO_LINKED | _IO_NO_WRITES | _IO_LINE_BUF))
110
    == (_IO_LINKED | _IO_LINE_BUF))
111
  _IO_OVERFLOW (stdout, EOF);
112

113
      _IO_release_lock (stdout);
114
    }
115

116
  _IO_switch_to_get_mode (fp);
117

118
  fp->_wide_data->_IO_read_base = fp->_wide_data->_IO_read_ptr =
119
    fp->_wide_data->_IO_buf_base;
120
  fp->_wide_data->_IO_read_end = fp->_wide_data->_IO_buf_base;
121
  fp->_wide_data->_IO_write_base = fp->_wide_data->_IO_write_ptr =
122
    fp->_wide_data->_IO_write_end = fp->_wide_data->_IO_buf_base;
123

124
  const char *read_ptr_copy;
125
  char accbuf[MB_LEN_MAX];
126
  size_t naccbuf = 0;
127
 again:
128
  count = _IO_SYSREAD (fp, fp->_IO_read_end,
129
           fp->_IO_buf_end - fp->_IO_read_end);
130
  if (count <= 0)
131
    {
132
      if (count == 0 && naccbuf == 0)
133
  {
134
    fp->_flags |= _IO_EOF_SEEN;
135
    fp->_offset = _IO_pos_BAD;
136
  }
137
      else
138
  fp->_flags |= _IO_ERR_SEEN, count = 0;
139
    }
140
  fp->_IO_read_end += count;
141
  if (count == 0)
142
    {
143
      if (naccbuf != 0)
144
  /* There are some bytes in the external buffer but they don't
145
     convert to anything.  */
146
  __set_errno (EILSEQ);
147
      return WEOF;
148
    }
149
  if (fp->_offset != _IO_pos_BAD)
150
    _IO_pos_adjust (fp->_offset, count);
151

152
  /* Now convert the read input.  */
153
  fp->_wide_data->_IO_last_state = fp->_wide_data->_IO_state;
154
  fp->_IO_read_base = fp->_IO_read_ptr;
155
  const char *from = fp->_IO_read_ptr;
156
  const char *to = fp->_IO_read_end;
157
  size_t to_copy = count;
158
  if (__glibc_unlikely (naccbuf != 0))
159
    {
160
      to_copy = MIN (sizeof (accbuf) - naccbuf, count);
161
      to = __mempcpy (&accbuf[naccbuf], from, to_copy);
162
      naccbuf += to_copy;
163
      from = accbuf;
164
    }
165
  status = __libio_codecvt_in (cd, &fp->_wide_data->_IO_state,
166
             from, to, &read_ptr_copy,
167
             fp->_wide_data->_IO_read_end,
168
             fp->_wide_data->_IO_buf_end,
169
             &fp->_wide_data->_IO_read_end);
170

171
  if (__glibc_unlikely (naccbuf != 0))
172
    fp->_IO_read_ptr += MAX (0, read_ptr_copy - &accbuf[naccbuf - to_copy]);
173
  else
174
    fp->_IO_read_ptr = (char *) read_ptr_copy;
175
  if (fp->_wide_data->_IO_read_end == fp->_wide_data->_IO_buf_base)
176
    {
177
      if (status == __codecvt_error)
178
  {
179
  out_eilseq:
180
    __set_errno (EILSEQ);
181
    fp->_flags |= _IO_ERR_SEEN;
182
    return WEOF;
183
  }
184

185
      /* The read bytes make no complete character.  Try reading again.  */
186
      assert (status == __codecvt_partial);
187

188
      if (naccbuf == 0)
189
  {
190
    if (fp->_IO_read_base < fp->_IO_read_ptr)
191
      {
192
        /* Partially used the buffer for some input data that
193
     produces no output.  */
194
        size_t avail = fp->_IO_read_end - fp->_IO_read_ptr;
195
        memmove (fp->_IO_read_base, fp->_IO_read_ptr, avail);
196
        fp->_IO_read_ptr = fp->_IO_read_base;
197
        fp->_IO_read_end -= avail;
198
        goto again;
199
      }
200
    naccbuf = fp->_IO_read_end - fp->_IO_read_ptr;
201
    if (naccbuf >= sizeof (accbuf))
202
      goto out_eilseq;
203

204
    memcpy (accbuf, fp->_IO_read_ptr, naccbuf);
205
  }
206
      else
207
  {
208
    size_t used = read_ptr_copy - accbuf;
209
    if (used > 0)
210
      {
211
        memmove (accbuf, read_ptr_copy, naccbuf - used);
212
        naccbuf -= used;
213
      }
214

215
    if (naccbuf == sizeof (accbuf))
216
      goto out_eilseq;
217
  }
218

219
      fp->_IO_read_ptr = fp->_IO_read_end = fp->_IO_read_base;
220

221
      goto again;
222
    }
223

224
  return *fp->_wide_data->_IO_read_ptr;
225
}
226
libc_hidden_def (_IO_wfile_underflow)

1
case __GCONV_FULL_OUTPUT:
2
case __GCONV_INCOMPLETE_INPUT:
3
  result = __codecvt_partial;
4
  break;
5

6
default:
7
  result = __codecvt_error;
8
  break;
9
}

1
</div>
2
</details>
3

4

5
여기에서 함수 포인터로 참조되는 멤버의 구조는 다음과 같이 구성되게됩니다.
6

7
<p align="center"><img width="100%" src="/assets/img/CVE-2024-6387/structure_graph.png"/></p>
8

9
<details>
10
<summary>libio/libioP.h</summary>
11
<div markdown="1">
12
```c
13
struct _IO_jump_t
14
{
15
    JUMP_FIELD(size_t, __dummy);
16
    JUMP_FIELD(size_t, __dummy2);
17
    JUMP_FIELD(_IO_finish_t, __finish);
18
    JUMP_FIELD(_IO_overflow_t, __overflow);
19
    JUMP_FIELD(_IO_underflow_t, __underflow);
20
    JUMP_FIELD(_IO_underflow_t, __uflow);
21
    JUMP_FIELD(_IO_pbackfail_t, __pbackfail);
22
    /* showmany */
23
    JUMP_FIELD(_IO_xsputn_t, __xsputn);
24
    JUMP_FIELD(_IO_xsgetn_t, __xsgetn);
25
    JUMP_FIELD(_IO_seekoff_t, __seekoff);
26
    JUMP_FIELD(_IO_seekpos_t, __seekpos);
27
    JUMP_FIELD(_IO_setbuf_t, __setbuf);
28
    JUMP_FIELD(_IO_sync_t, __sync);
29
    JUMP_FIELD(_IO_doallocate_t, __doallocate);
30
    JUMP_FIELD(_IO_read_t, __read);
31
    JUMP_FIELD(_IO_write_t, __write);
32
    JUMP_FIELD(_IO_seek_t, __seek);
33
    JUMP_FIELD(_IO_close_t, __close);
34
    JUMP_FIELD(_IO_stat_t, __stat);
35
    JUMP_FIELD(_IO_showmanyc_t, __showmanyc);
36
    JUMP_FIELD(_IO_imbue_t, __imbue);
37
};
38

39
/* We always allocate an extra word following an _IO_FILE.
40
   This contains a pointer to the function jump table used.
41
   This is for compatibility with C++ streambuf; the word can
42
   be used to smash to a pointer to a virtual function table. */
43

44
struct _IO_FILE_plus
45
{
46
  FILE file;
47
  const struct _IO_jump_t *vtable;
48
};

1
</div>
2
</details>
3

4
<details>
5
<summary>libio.h:_IO_codecvt</summary>
6
<div markdown="1">
7
```c
8
struct _IO_codecvt
9
{
10
  _IO_iconv_t __cd_in;
11
  _IO_iconv_t __cd_out;
12
};

1
</div>
2
</details>
3

4
<details>
5
<summary>iconv/gconv.h:__gconv_fct</summary>
6
<div markdown="1">
7
```c
8
/* Type of a conversion function.  */
9
typedef int (*__gconv_fct) (struct __gconv_step *, struct __gconv_step_data *,
10
          const unsigned char **, const unsigned char *,
11
          unsigned char **, size_t *, int, int);