[libcxx] Fix a bug in strstreambuf::overflow.

The end pointer should point to one past the end of the newly allocated
buffer.

rdar://problem/24265174

Differential Revision: http://reviews.llvm.org/D20334

llvm-svn: 274132

2 files changed, 33 insertions, 2 deletions

diff --git a/libcxx/src/strstream.cpp b/libcxx/src/strstream.cpp
index 83702fc72e8..0e2d7ff21bb 100644
--- a/libcxx/src/strstream.cpp
+++ b/libcxx/src/strstream.cpp
@@ -175,7 +175,6 @@ strstreambuf::overflow(int_type __c)
         ptrdiff_t ninp = gptr()  - eback();
         ptrdiff_t einp = egptr() - eback();
         ptrdiff_t nout = pptr()  - pbase();
-        ptrdiff_t eout = epptr() - pbase();
         if (__strmode_ & __allocated)
         {
             if (__pfree_)
@@ -184,7 +183,7 @@ strstreambuf::overflow(int_type __c)
                 delete [] eback();
         }
         setg(buf, buf + ninp, buf + einp);
-        setp(buf + einp, buf + einp + eout);
+        setp(buf + einp, buf + new_size);
         pbump(static_cast<int>(nout));
         __strmode_ |= __allocated;
     }
diff --git a/libcxx/test/std/depr/depr.str.strstreams/depr.strstreambuf/depr.strstreambuf.members/overflow.pass.cpp b/libcxx/test/std/depr/depr.str.strstreams/depr.strstreambuf/depr.strstreambuf.members/overflow.pass.cpp
new file mode 100644
index 00000000000..2336eb051ea
--- /dev/null
+++ b/libcxx/test/std/depr/depr.str.strstreams/depr.strstreambuf/depr.strstreambuf.members/overflow.pass.cpp
@@ -0,0 +1,32 @@
+//===----------------------------------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is dual licensed under the MIT and the University of Illinois Open
+// Source Licenses. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+// <strstream>
+
+// class strstreambuf
+
+// int overflow(int c);
+
+#include <iostream>
+#include <string>
+#include <strstream>
+
+int main(int, char const **argv) {
+  std::ostrstream oss;
+  std::string s;
+
+  for (int i = 0; i < 4096; ++i)
+    s.push_back((i % 16) + 'a');
+
+  oss << s << std::ends;
+  std::cout << oss.str();
+  oss.freeze(false);
+
+  return 0;
+}