[net.bugs.4bsd] Possible fopen bug

whm (04/05/83)

I think I might have found a bug in the 4.1bsd fopen routine.
At the start of stdio/fopen.c, the following code appears:

	for (iop = _iob; iop->_flag&(_IOREAD|_IOWRT|_IORW); iop++)
		if (iop >= _lastbuf)
			return(NULL);

The purpose of this segment is apparently to find an unused element
of the iob array.  The problem with this is that it's possible
to exit the loop with iop == _lastbuf, which should never happen.
When it does, a variety of program malfunctions can occur, based
on what lies after the last element of _iob.  Being a pedantic
C coder, I suggest adding the following code after the "for" loop:
			
	if (iop >= _lastbuf)
		return(NULL);

Similar code appears in fdopen.c.

When I was trying to find this bug, I was using adb (and sdb).  When
I ran the program with adb, the program worked ok.  When I just ran
the program, it blew up.  It seems like I've had this (programs not
being buggy inside a debugger) happen before, does anybody know
any general causes of this phenomenon?

					Bill Mitchell
					The U of Arizona