Bug 23077 - illegitimate use of setlocale(), atof()
Summary: illegitimate use of setlocale(), atof()
Status: RESOLVED FIXED
Alias: None
Product: poppler
Classification: Unclassified
Component: general (show other bugs)
Version: unspecified
Hardware: All All
: medium normal
Assignee: poppler-bugs
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-08-01 06:39 UTC by Jakub Wilk
Modified: 2009-08-17 10:13 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments

Description Jakub Wilk 2009-08-01 06:39:58 UTC
$ cd poppler-0.10.6/
$ grep -C1 -r setlocale poppler

poppler/PDFDoc.cc-  {
poppler/PDFDoc.cc:    char *theLocale = setlocale(LC_NUMERIC, "C");
poppler/PDFDoc.cc-    pdfVersion = atof(p);
poppler/PDFDoc.cc:    setlocale(LC_NUMERIC, theLocale);
poppler/PDFDoc.cc-  }


The code fails to restore the original locale settings. Even if those settings
were being restored, the code would be susceptible to race conditions in
multi-threaded applications. (It is almost always a bad idea to call
setlocale() in a library!)

Moreover, other uses atof() in poppler are not "protected" by setlocale()
calls, so they essentially rely on the brokenness of the quoted code.
Comment 1 Albert Astals Cid 2009-08-13 14:41:26 UTC
any suggestion?
Comment 2 Jakub Wilk 2009-08-14 04:06:03 UTC
The only portable and thread-safe solution I'm aware of is to replace atof() calls with calls to a custom function that does not use the C locale subsystem.
Comment 3 Albert Astals Cid 2009-08-16 15:17:20 UTC
Fixed, will be in next poppler version
Comment 4 Jakub Wilk 2009-08-17 03:31:14 UTC
Thanks, that's much better.

However, a race condition window is still there:
If another thread called setlocale() with different decimal_separator between localeconv() and strtod() calls, you would get wrong results.
Comment 5 Albert Astals Cid 2009-08-17 10:13:58 UTC
I can live with that, if you app calls setlocale in between of it's execution it's doing weird things and you deserve to be punished. At most if you want we can try to put a warning somewhere of our not very extense documentation.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.