From 14ba5e14d9226cb4dd1b2a72781ee02e9f2bf8a2 Mon Sep 17 00:00:00 2001
From: Jeff Johnston <jjohnstn@redhat.com>
Date: Thu, 15 Mar 2007 18:40:48 +0000
Subject: [PATCH] 2007-03-15  Eric Blake  <ebb9@byu.net>

	* libc/stdio/local.h (cantwrite, FREEUB, FREELB): Make reentrant.
	(__smakebuf): Rename...
	(__smakebuf_r): to this.
	* libc/stdio/fvwrite.h (__swsetup_r): Rename, from __swsetup.
	* libc/stdio/makebuf.c (__smakebuf): Detect failed asprint
	allocation, then rename...
	(__smakebuf_r): ...to this and fix reentrancy.
	* libc/stdio/wsetup.c (__swsetup): Detect failed asprintf
	allocation, then rename...
	(__swsetup_r): ...to this and fix reentrancy.
	* libc/stdio/fseek.c (_fseek_r): Fix reentrancy.
	* libc/stdio/refill.c (__srefill_r): Likewise.
	* libc/stdio/fclose.c (_fclose_r): Likewise.
	* libc/stdio/fread.c (_fread_r): Likewise.
	* libc/stdio/freopen.c (_freopen_r): Likewise.
	* libc/stdio/wbuf.c (__swbuf_r): Likewise.
	* libc/stdio64/fseeko64.c (_fseeko64_r): Likewise.
	* libc/stdio/fvwrite.c (__sfvwrite_r): Set errno properly on
	failed asprintf allocation, and fix reentrancy.
	* libc/stdio/snprintf.c (snprintf, _snprintf_r): Report overflow,
	as required by POSIX.
	* libc/stdio/sniprintf.c (sniprintf, _sniprintf_r): Likewise.
	* libc/stdio/vsnprintf.c (vsnprintf, _vsnprintf_r): Likewise.
	* libc/stdio/vsniprintf.c (vsniprintf, _vsniprintf_r): Likewise.
---
 newlib/ChangeLog               | 27 +++++++++++++++++++++++++++
 newlib/libc/stdio/fclose.c     |  7 +++----
 newlib/libc/stdio/fread.c      |  4 ++--
 newlib/libc/stdio/freopen.c    |  6 +++---
 newlib/libc/stdio/fseek.c      | 10 +++++-----
 newlib/libc/stdio/fvwrite.c    |  4 +++-
 newlib/libc/stdio/fvwrite.h    |  6 ++----
 newlib/libc/stdio/local.h      | 15 ++++++++-------
 newlib/libc/stdio/makebuf.c    | 22 +++++++++++++---------
 newlib/libc/stdio/refill.c     |  8 ++++----
 newlib/libc/stdio/sniprintf.c  | 20 ++++++++++++++++++--
 newlib/libc/stdio/snprintf.c   | 20 ++++++++++++++++++--
 newlib/libc/stdio/vfprintf.c   |  2 +-
 newlib/libc/stdio/vsniprintf.c | 20 ++++++++++++++++++--
 newlib/libc/stdio/vsnprintf.c  | 20 ++++++++++++++++++--
 newlib/libc/stdio/wbuf.c       |  4 ++--
 newlib/libc/stdio/wsetup.c     | 11 ++++++-----
 17 files changed, 151 insertions(+), 55 deletions(-)

diff --git a/newlib/ChangeLog b/newlib/ChangeLog
index 13e006f76..29b9e0de8 100644
--- a/newlib/ChangeLog
+++ b/newlib/ChangeLog
@@ -1,3 +1,30 @@
+2007-03-15  Eric Blake  <ebb9@byu.net>
+
+	* libc/stdio/local.h (cantwrite, FREEUB, FREELB): Make reentrant.
+	(__smakebuf): Rename...
+	(__smakebuf_r): to this.
+	* libc/stdio/fvwrite.h (__swsetup_r): Rename, from __swsetup.
+	* libc/stdio/makebuf.c (__smakebuf): Detect failed asprint
+	allocation, then rename...
+	(__smakebuf_r): ...to this and fix reentrancy.
+	* libc/stdio/wsetup.c (__swsetup): Detect failed asprintf
+	allocation, then rename...
+	(__swsetup_r): ...to this and fix reentrancy.
+	* libc/stdio/fseek.c (_fseek_r): Fix reentrancy.
+	* libc/stdio/refill.c (__srefill_r): Likewise.
+	* libc/stdio/fclose.c (_fclose_r): Likewise.
+	* libc/stdio/fread.c (_fread_r): Likewise.
+	* libc/stdio/freopen.c (_freopen_r): Likewise.
+	* libc/stdio/wbuf.c (__swbuf_r): Likewise.
+	* libc/stdio64/fseeko64.c (_fseeko64_r): Likewise.
+	* libc/stdio/fvwrite.c (__sfvwrite_r): Set errno properly on
+	failed asprintf allocation, and fix reentrancy.
+	* libc/stdio/snprintf.c (snprintf, _snprintf_r): Report overflow,
+	as required by POSIX.
+	* libc/stdio/sniprintf.c (sniprintf, _sniprintf_r): Likewise.
+	* libc/stdio/vsnprintf.c (vsnprintf, _vsnprintf_r): Likewise.
+	* libc/stdio/vsniprintf.c (vsniprintf, _vsniprintf_r): Likewise.
+
 2007-03-12  Eric Blake  <ebb9@byu.net>
 
 	* libc/stdio/fvwrite.c (__sfvwrite_r): Fix reentrancy.
diff --git a/newlib/libc/stdio/fclose.c b/newlib/libc/stdio/fclose.c
index 08df75fb4..d7cfdafa5 100644
--- a/newlib/libc/stdio/fclose.c
+++ b/newlib/libc/stdio/fclose.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -95,9 +95,9 @@ _DEFUN(_fclose_r, (rptr, fp),
   if (fp->_flags & __SMBF)
     _free_r (rptr, (char *) fp->_bf._base);
   if (HASUB (fp))
-    FREEUB (fp);
+    FREEUB (rptr, fp);
   if (HASLB (fp))
-    FREELB (fp);
+    FREELB (rptr, fp);
   fp->_flags = 0;		/* release this FILE for reuse */
   _funlockfile (fp);
 #ifndef __SINGLE_THREAD__
@@ -119,4 +119,3 @@ _DEFUN(fclose, (fp),
 }
 
 #endif
-
diff --git a/newlib/libc/stdio/fread.c b/newlib/libc/stdio/fread.c
index c2c248979..596952bec 100644
--- a/newlib/libc/stdio/fread.c
+++ b/newlib/libc/stdio/fread.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -168,7 +168,7 @@ _DEFUN(_fread_r, (ptr, buf, size, count, fp),
 
       /* If still more data needed, free any allocated ungetc buffer.  */
       if (HASUB (fp) && resid > 0)
-	FREEUB (fp);
+	FREEUB (ptr, fp);
 
       /* Finally read directly into user's buffer if needed.  */
       while (resid > 0)
diff --git a/newlib/libc/stdio/freopen.c b/newlib/libc/stdio/freopen.c
index 445baf1ac..6d885db2c 100644
--- a/newlib/libc/stdio/freopen.c
+++ b/newlib/libc/stdio/freopen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990, 2006 The Regents of the University of California.
+ * Copyright (c) 1990, 2006, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -196,10 +196,10 @@ _DEFUN(_freopen_r, (ptr, file, mode, fp),
   fp->_bf._size = 0;
   fp->_lbfsize = 0;
   if (HASUB (fp))
-    FREEUB (fp);
+    FREEUB (ptr, fp);
   fp->_ub._size = 0;
   if (HASLB (fp))
-    FREELB (fp);
+    FREELB (ptr, fp);
   fp->_lb._size = 0;
 
   if (f < 0)
diff --git a/newlib/libc/stdio/fseek.c b/newlib/libc/stdio/fseek.c
index 9944fd809..9ba9fac36 100644
--- a/newlib/libc/stdio/fseek.c
+++ b/newlib/libc/stdio/fseek.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -213,7 +213,7 @@ _DEFUN(_fseek_r, (ptr, fp, offset, whence),
    */
 
   if (fp->_bf._base == NULL)
-    __smakebuf (fp);
+    __smakebuf_r (ptr, fp);
   if (fp->_flags & (__SWR | __SRW | __SNBF | __SNPT))
     goto dumb;
   if ((fp->_flags & __SOPT) == 0)
@@ -307,7 +307,7 @@ _DEFUN(_fseek_r, (ptr, fp, offset, whence),
       fp->_p = fp->_bf._base + o;
       fp->_r = n - o;
       if (HASUB (fp))
-	FREEUB (fp);
+	FREEUB (ptr, fp);
       fp->_flags &= ~__SEOF;
       _funlockfile (fp);
       return 0;
@@ -328,7 +328,7 @@ _DEFUN(_fseek_r, (ptr, fp, offset, whence),
   fp->_r = 0;
   fp->_p = fp->_bf._base;
   if (HASUB (fp))
-    FREEUB (fp);
+    FREEUB (ptr, fp);
   fp->_flags &= ~__SEOF;
   n = target - curoff;
   if (n)
@@ -354,7 +354,7 @@ dumb:
     }
   /* success: clear EOF indicator and discard ungetc() data */
   if (HASUB (fp))
-    FREEUB (fp);
+    FREEUB (ptr, fp);
   fp->_p = fp->_bf._base;
   fp->_r = 0;
   /* fp->_w = 0; *//* unnecessary (I think...) */
diff --git a/newlib/libc/stdio/fvwrite.c b/newlib/libc/stdio/fvwrite.c
index 21167c7f1..0d91aa2d9 100644
--- a/newlib/libc/stdio/fvwrite.c
+++ b/newlib/libc/stdio/fvwrite.c
@@ -60,7 +60,7 @@ _DEFUN(__sfvwrite_r, (ptr, fp, uio),
     return 0;
 
   /* make sure we can write */
-  if (cantwrite (fp))
+  if (cantwrite (ptr, fp))
     {
       fp->_flags |= __SERR;
       ptr->_errno = EBADF;
@@ -147,6 +147,8 @@ _DEFUN(__sfvwrite_r, (ptr, fp, uio),
 		    {
 		      /* Free buffer which is no longer used.  */
 		      _free_r (ptr, fp->_bf._base);
+                      /* Ensure correct errno, even if free changed it.  */
+                      ptr->_errno = ENOMEM;
 		      goto err;
 		    }
 		  fp->_bf._base = str;
diff --git a/newlib/libc/stdio/fvwrite.h b/newlib/libc/stdio/fvwrite.h
index 901b56058..848d5b261 100644
--- a/newlib/libc/stdio/fvwrite.h
+++ b/newlib/libc/stdio/fvwrite.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -33,6 +33,4 @@ struct __suio {
 
 
 extern int _EXFUN(__sfvwrite_r,(struct _reent *, FILE *, struct __suio *));
-extern int _EXFUN(__swsetup,(FILE *));
-
-
+extern int _EXFUN(__swsetup_r,(struct _reent *, FILE *));
diff --git a/newlib/libc/stdio/local.h b/newlib/libc/stdio/local.h
index 9ae9b4046..704b6be03 100644
--- a/newlib/libc/stdio/local.h
+++ b/newlib/libc/stdio/local.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -41,7 +41,7 @@ extern int    _EXFUN(__sclose,(_PTR));
 extern int    _EXFUN(__stextmode,(int));
 extern _VOID   _EXFUN(__sinit,(struct _reent *));
 extern _VOID   _EXFUN(_cleanup_r,(struct _reent *));
-extern _VOID   _EXFUN(__smakebuf,(FILE *));
+extern _VOID   _EXFUN(__smakebuf_r,(struct _reent *, FILE *));
 extern int    _EXFUN(_fwalk,(struct _reent *, int (*)(FILE *)));
 extern int    _EXFUN(_fwalk_reent,(struct _reent *, int (*)(struct _reent *, FILE *)));
 struct _glue * _EXFUN(__sfmoreglue,(struct _reent *,int n));
@@ -82,24 +82,25 @@ struct _glue * _EXFUN(__sfmoreglue,(struct _reent *,int n));
 
 /* Return true iff the given FILE cannot be written now.  */
 
-#define	cantwrite(fp) \
+#define	cantwrite(ptr, fp)                                     \
   ((((fp)->_flags & __SWR) == 0 || (fp)->_bf._base == NULL) && \
-   __swsetup(fp))
+   __swsetup_r(ptr, fp))
 
 /* Test whether the given stdio file has an active ungetc buffer;
    release such a buffer, without restoring ordinary unread data.  */
 
 #define	HASUB(fp) ((fp)->_ub._base != NULL)
-#define	FREEUB(fp) { \
+#define	FREEUB(ptr, fp) {                    \
 	if ((fp)->_ub._base != (fp)->_ubuf) \
-		_free_r(_REENT, (char *)(fp)->_ub._base); \
+		_free_r(ptr, (char *)(fp)->_ub._base); \
 	(fp)->_ub._base = NULL; \
 }
 
 /* Test for an fgetline() buffer.  */
 
 #define	HASLB(fp) ((fp)->_lb._base != NULL)
-#define	FREELB(fp) { _free_r(_REENT,(char *)(fp)->_lb._base); (fp)->_lb._base = NULL; }
+#define	FREELB(ptr, fp) { _free_r(ptr,(char *)(fp)->_lb._base); \
+      (fp)->_lb._base = NULL; }
 
 /* WARNING: _dcvt is defined in the stdlib directory, not here!  */
 
diff --git a/newlib/libc/stdio/makebuf.c b/newlib/libc/stdio/makebuf.c
index 9808cd5ec..340ea28c5 100644
--- a/newlib/libc/stdio/makebuf.c
+++ b/newlib/libc/stdio/makebuf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -35,7 +35,8 @@
  */
 
 _VOID
-_DEFUN(__smakebuf, (fp),
+_DEFUN(__smakebuf_r, (ptr, fp),
+       struct _reent *ptr _AND
        register FILE *fp)
 {
   register size_t size, couldbetty;
@@ -49,9 +50,9 @@ _DEFUN(__smakebuf, (fp),
       return;
     }
 #ifdef __USE_INTERNAL_STAT64
-  if (fp->_file < 0 || _fstat64_r (_REENT, fp->_file, &st) < 0)
+  if (fp->_file < 0 || _fstat64_r (ptr, fp->_file, &st) < 0)
 #else
-  if (fp->_file < 0 || _fstat_r (_REENT, fp->_file, &st) < 0)
+  if (fp->_file < 0 || _fstat_r (ptr, fp->_file, &st) < 0)
 #endif
     {
       couldbetty = 0;
@@ -87,15 +88,18 @@ _DEFUN(__smakebuf, (fp),
       else
 	fp->_flags |= __SNPT;
     }
-  if ((p = _malloc_r (_REENT, size)) == NULL)
+  if ((p = _malloc_r (ptr, size)) == NULL)
     {
-      fp->_flags |= __SNBF;
-      fp->_bf._base = fp->_p = fp->_nbuf;
-      fp->_bf._size = 1;
+      if (!(fp->_flags & __SSTR))
+	{
+	  fp->_flags |= __SNBF;
+	  fp->_bf._base = fp->_p = fp->_nbuf;
+	  fp->_bf._size = 1;
+	}
     }
   else
     {
-      _REENT->__cleanup = _cleanup_r;
+      ptr->__cleanup = _cleanup_r;
       fp->_flags |= __SMBF;
       fp->_bf._base = fp->_p = (unsigned char *) p;
       fp->_bf._size = size;
diff --git a/newlib/libc/stdio/refill.c b/newlib/libc/stdio/refill.c
index 75ba0565f..71a1e565f 100644
--- a/newlib/libc/stdio/refill.c
+++ b/newlib/libc/stdio/refill.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -43,7 +43,7 @@ _DEFUN(__srefill_r, (ptr, fp),
 {
   /* make sure stdio is set up */
 
-  CHECK_INIT (_REENT, fp);
+  CHECK_INIT (ptr, fp);
 
   fp->_r = 0;			/* largely a convenience for callers */
 
@@ -83,7 +83,7 @@ _DEFUN(__srefill_r, (ptr, fp),
        */
       if (HASUB (fp))
 	{
-	  FREEUB (fp);
+	  FREEUB (ptr, fp);
 	  if ((fp->_r = fp->_ur) != 0)
 	    {
 	      fp->_p = fp->_up;
@@ -93,7 +93,7 @@ _DEFUN(__srefill_r, (ptr, fp),
     }
 
   if (fp->_bf._base == NULL)
-    __smakebuf (fp);
+    __smakebuf_r (ptr, fp);
 
   /*
    * Before reading from a line buffered or unbuffered file,
diff --git a/newlib/libc/stdio/sniprintf.c b/newlib/libc/stdio/sniprintf.c
index 7650cd080..8059b53f3 100644
--- a/newlib/libc/stdio/sniprintf.c
+++ b/newlib/libc/stdio/sniprintf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -26,6 +26,7 @@
 #include <varargs.h>
 #endif
 #include <limits.h>
+#include <errno.h>
 #include "local.h"
 
 int
@@ -48,6 +49,11 @@ _sniprintf_r (ptr, str, size, fmt, va_alist)
   va_list ap;
   FILE f;
 
+  if (size > INT_MAX)
+    {
+      ptr->_errno = EOVERFLOW;
+      return EOF;
+    }
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
@@ -59,6 +65,8 @@ _sniprintf_r (ptr, str, size, fmt, va_alist)
 #endif
   ret = _vfiprintf_r (ptr, &f, fmt, ap);
   va_end (ap);
+  if (ret < EOF)
+    ptr->_errno = EOVERFLOW;
   if (size > 0)
     *f._p = 0;
   return (ret);
@@ -83,7 +91,13 @@ sniprintf (str, size, fmt, va_alist)
   int ret;
   va_list ap;
   FILE f;
+  struct _reent *ptr = _REENT;
 
+  if (size > INT_MAX)
+    {
+      ptr->_errno = EOVERFLOW;
+      return EOF;
+    }
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
@@ -93,8 +107,10 @@ sniprintf (str, size, fmt, va_alist)
 #else
   va_start (ap);
 #endif
-  ret = _vfiprintf_r (_REENT, &f, fmt, ap);
+  ret = _vfiprintf_r (ptr, &f, fmt, ap);
   va_end (ap);
+  if (ret < EOF)
+    ptr->_errno = EOVERFLOW;
   if (size > 0)
     *f._p = 0;
   return (ret);
diff --git a/newlib/libc/stdio/snprintf.c b/newlib/libc/stdio/snprintf.c
index 9c5c7cbb4..52db2dd2c 100644
--- a/newlib/libc/stdio/snprintf.c
+++ b/newlib/libc/stdio/snprintf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -26,6 +26,7 @@
 #include <varargs.h>
 #endif
 #include <limits.h>
+#include <errno.h>
 #include "local.h"
 
 int
@@ -48,6 +49,11 @@ _snprintf_r(ptr, str, size, fmt, va_alist)
   va_list ap;
   FILE f;
 
+  if (size > INT_MAX)
+    {
+      ptr->_errno = EOVERFLOW;
+      return EOF;
+    }
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
@@ -59,6 +65,8 @@ _snprintf_r(ptr, str, size, fmt, va_alist)
 #endif
   ret = _vfprintf_r (ptr, &f, fmt, ap);
   va_end (ap);
+  if (ret < EOF)
+    ptr->_errno = EOVERFLOW;
   if (size > 0)
     *f._p = 0;
   return (ret);
@@ -83,7 +91,13 @@ snprintf(str, size, fmt, va_alist)
   int ret;
   va_list ap;
   FILE f;
+  struct _reent *ptr = _REENT;
 
+  if (size > INT_MAX)
+    {
+      ptr->_errno = EOVERFLOW;
+      return EOF;
+    }
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
@@ -93,8 +107,10 @@ snprintf(str, size, fmt, va_alist)
 #else
   va_start (ap);
 #endif
-  ret = _vfprintf_r (_REENT, &f, fmt, ap);
+  ret = _vfprintf_r (ptr, &f, fmt, ap);
   va_end (ap);
+  if (ret < EOF)
+    ptr->_errno = EOVERFLOW;
   if (size > 0)
     *f._p = 0;
   return (ret);
diff --git a/newlib/libc/stdio/vfprintf.c b/newlib/libc/stdio/vfprintf.c
index d8e46a2d1..30155ffc0 100644
--- a/newlib/libc/stdio/vfprintf.c
+++ b/newlib/libc/stdio/vfprintf.c
@@ -544,7 +544,7 @@ _DEFUN(_VFPRINTF_R, (data, fp, fmt0, ap),
 	_flockfile (fp);
 
 	/* sorry, fprintf(read_only_file, "") returns EOF, not 0 */
-	if (cantwrite (fp)) {
+	if (cantwrite (data, fp)) {
 		_funlockfile (fp);	
 		return (EOF);
 	}
diff --git a/newlib/libc/stdio/vsniprintf.c b/newlib/libc/stdio/vsniprintf.c
index 6a5bd45bb..68f0c7f02 100644
--- a/newlib/libc/stdio/vsniprintf.c
+++ b/newlib/libc/stdio/vsniprintf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -68,6 +68,7 @@ static char sccsid[] = "%W% (Berkeley) %G%";
 #else
 #include <varargs.h>
 #endif
+#include <errno.h>
 
 #ifndef _REENT_ONLY
 
@@ -80,12 +81,20 @@ _DEFUN(vsniprintf, (str, size, fmt, ap),
 {
   int ret;
   FILE f;
+  struct _reent *ptr = _REENT;
 
+  if (size > INT_MAX)
+    {
+      ptr->_errno = EOVERFLOW;
+      return EOF;
+    }
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
-  ret = _vfiprintf_r (_REENT, &f, fmt, ap);
+  ret = _vfiprintf_r (ptr, &f, fmt, ap);
+  if (ret < EOF)
+    ptr->_errno = EOVERFLOW;
   if (size > 0)
     *f._p = 0;
   return ret;
@@ -104,11 +113,18 @@ _DEFUN(_vsniprintf_r, (ptr, str, size, fmt, ap),
   int ret;
   FILE f;
 
+  if (size > INT_MAX)
+    {
+      ptr->_errno = EOVERFLOW;
+      return EOF;
+    }
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
   ret = _vfiprintf_r (ptr, &f, fmt, ap);
+  if (ret < EOF)
+    ptr->_errno = EOVERFLOW;
   if (size > 0)
     *f._p = 0;
   return ret;
diff --git a/newlib/libc/stdio/vsnprintf.c b/newlib/libc/stdio/vsnprintf.c
index 9fc1b2d89..e935b49c1 100644
--- a/newlib/libc/stdio/vsnprintf.c
+++ b/newlib/libc/stdio/vsnprintf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -29,6 +29,7 @@ static char sccsid[] = "%W% (Berkeley) %G%";
 #else
 #include <varargs.h>
 #endif
+#include <errno.h>
 
 #ifndef _REENT_ONLY
 
@@ -41,12 +42,20 @@ _DEFUN(vsnprintf, (str, size, fmt, ap),
 {
   int ret;
   FILE f;
+  struct _reent *ptr = _REENT;
 
+  if (size > INT_MAX)
+    {
+      ptr->_errno = EOVERFLOW;
+      return EOF;
+    }
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
-  ret = _vfprintf_r (_REENT, &f, fmt, ap);
+  ret = _vfprintf_r (ptr, &f, fmt, ap);
+  if (ret < EOF)
+    ptr->_errno = EOVERFLOW;
   if (size > 0)
     *f._p = 0;
   return ret;
@@ -65,11 +74,18 @@ _DEFUN(_vsnprintf_r, (ptr, str, size, fmt, ap),
   int ret;
   FILE f;
 
+  if (size > INT_MAX)
+    {
+      ptr->_errno = EOVERFLOW;
+      return EOF;
+    }
   f._flags = __SWR | __SSTR;
   f._bf._base = f._p = (unsigned char *) str;
   f._bf._size = f._w = (size > 0 ? size - 1 : 0);
   f._file = -1;  /* No file. */
   ret = _vfprintf_r (ptr, &f, fmt, ap);
+  if (ret < EOF)
+    ptr->_errno = EOVERFLOW;
   if (size > 0)
     *f._p = 0;
   return ret;
diff --git a/newlib/libc/stdio/wbuf.c b/newlib/libc/stdio/wbuf.c
index 5f1e85a27..ea8f64d8d 100644
--- a/newlib/libc/stdio/wbuf.c
+++ b/newlib/libc/stdio/wbuf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -53,7 +53,7 @@ _DEFUN(__swbuf_r, (ptr, c, fp),
    */
 
   fp->_w = fp->_lbfsize;
-  if (cantwrite (fp))
+  if (cantwrite (ptr, fp))
     {
       fp->_flags |= __SERR;
       ptr->_errno = EBADF;
diff --git a/newlib/libc/stdio/wsetup.c b/newlib/libc/stdio/wsetup.c
index ba98813b3..dcbda0a35 100644
--- a/newlib/libc/stdio/wsetup.c
+++ b/newlib/libc/stdio/wsetup.c
@@ -1,7 +1,7 @@
 /* No user fns here. Pesch 15apr92. */
 
 /*
- * Copyright (c) 1990 The Regents of the University of California.
+ * Copyright (c) 1990, 2007 The Regents of the University of California.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms are permitted
@@ -29,7 +29,8 @@
  */
 
 int
-_DEFUN(__swsetup, (fp),
+_DEFUN(__swsetup_r, (ptr, fp),
+       struct _reent *ptr _AND
        register FILE * fp)
 {
   /* Make sure stdio is set up.  */
@@ -48,7 +49,7 @@ _DEFUN(__swsetup, (fp),
 	{
 	  /* clobber any ungetc data */
 	  if (HASUB (fp))
-	    FREEUB (fp);
+	    FREEUB (ptr, fp);
 	  fp->_flags &= ~(__SRD | __SEOF);
 	  fp->_r = 0;
 	  fp->_p = fp->_bf._base;
@@ -63,7 +64,7 @@ _DEFUN(__swsetup, (fp),
    */
   if (fp->_bf._base == NULL 
         && (!(fp->_flags & __SSTR) || (fp->_flags & __SMBF)))
-    __smakebuf (fp);
+    __smakebuf_r (ptr, fp);
 
   if (fp->_flags & __SLBF)
     {
@@ -78,5 +79,5 @@ _DEFUN(__swsetup, (fp),
   else
     fp->_w = fp->_flags & __SNBF ? 0 : fp->_bf._size;
 
-  return 0;
+  return (!fp->_bf._base && (fp->_flags & __SMBF)) ? EOF : 0;
 }