'locale -k LC_TIME' leads to seg. fault when processing 'alt_digits'

[chenxy at opencjk dot org]

>Submitter-Id:	net
>Originator:	Chen Xiangyang (Sean Chen)
>Organization:	OpenCJK
>Confidential:	no
>Synopsis:	'locale' leads to seg. fault when processing 'alt_digits'
>Severity:	critical
>Priority:	high
>Category:	libc
>Class:		sw-bug
>Release:	libc-2.1.96
>Environment:
Host type: i686-pc-linux-gnu
System: Linux cat.at.home 2.2.16-22 #1 Tue Aug 22 16:49:06 EDT 2000 i686 unknown
Architecture: i686

Addons: linuxthreads

Build CC: gcc
Compiler version: 2.96 20000731 (Red Hat Linux 7.0)
Kernel headers: 2.4.0-0.26
Symbol versioning: yes
Build static: yes
Build shared: yes
Build pic-default: no
Build profile: yes
Build omitfp: no
Build bounded: no
Build static-nss: no
Stdio: libio

>Description:
	libc/locale/programs/locale.c uses the following method to print
	out stringarray:

	    for (cnt = 0; cnt < item->max - 1; ++cnt)
	      {
		val = nl_langinfo (item->item_id + cnt);
		if (val != NULL)
		  print_escaped (val);
		putchar (';');
	      }

	    val = nl_langinfo (item->item_id + cnt);
	    if (val != NULL)
	      print_escaped (val);

	For 'alt_digits' and 'wide-alt_digits', it will not really print
	out the 100 members of 'alt_digits' and 'wide-alt_digits', but 
	try to print out 'alt_digits' field and next 99 fields defined
	in categories.def, i.e., era_d_t_fmt, era_t_fmt, and so on.  At
	some point, print_escaped() will encounter a memory violation.

>How-To-Repeat:
	locale -k LC_TIME
>Fix:
	Use another method to print out stringarray, it can correctly print
	out 'alt_digits' and 'wide-alt_digits' and do not affect printing
	of 'abday', 'day', 'abmon', 'mon' and their 'wide' alternatives.

	The patch to libc/locale/programs/locale.c is included here:

##########################
--- libc.old/locale/programs/locale.c	Wed Oct  4 18:51:20 2000
+++ libc/locale/programs/locale.c	Tue Oct 31 10:39:13 2000
@@ -526,7 +526,7 @@
 
 /* Some of the "string" we print contain non-printable characters.  We
    encode them here.  */
-static void
+static const char *
 print_escaped (const char *string)
 {
   const unsigned char *ch;
@@ -540,6 +540,8 @@
 	printf("<0x%02x>", *ch);
       ++ch;
     }
+
+  return ++ch;
 }
 
 
@@ -571,15 +573,14 @@
 	    if (show_keyword_name)
 	      putchar ('"');
 
+	    val = nl_langinfo (item->item_id);
 	    for (cnt = 0; cnt < item->max - 1; ++cnt)
 	      {
-		val = nl_langinfo (item->item_id + cnt);
 		if (val != NULL)
-		  print_escaped (val);
+		  val = print_escaped (val);
 		putchar (';');
 	      }
 
-	    val = nl_langinfo (item->item_id + cnt);
 	    if (val != NULL)
 	      print_escaped (val);
 
##########################