PATCH: BPs for libio & stdio.

[Greg McGary <greg at kayak dot mcgary dot org>]

Uli,

You had a problem with this patch when you saw it in weeks past.  The
problem I need to solve is that the bounds of a stdio FILE handle need
to include the _IO_FILE_plus member vtable.  The way the code is
written now, the assorted stdio open functions return only the
_IO_FILE portion, with vtable excluded, so later uses of the FILE*
that want vtable get bounds violations.  We need to return a
_IO_FILE_plus* to the user on open, so that when the user passes it
back to us it has the proper bounds for accessing vtable.  This should
be safe since _IO_FILE_plus and _IO_FILE always start at the same
address.

The patch below is minimally invasive, but uses more casts than
I'd like.  Changing _IO_{new_,old_,}file_init to accept
_IO_FILE_plus* will help.

Please advise.

Index: libio/iofdopen.c
===================================================================
RCS file: /cvs/glibc/libc/libio/iofdopen.c,v
retrieving revision 1.14
diff -u -p -r1.14 iofdopen.c
--- iofdopen.c	2000/03/21 23:06:40	1.14
+++ iofdopen.c	2000/06/27 17:47:36
@@ -123,8 +123,8 @@ _IO_new_fdopen (fd, mode)
   new_f->fp.file._lock = &new_f->lock;
 #endif
   _IO_no_init (&new_f->fp.file, 0, 0, &new_f->wd, &_IO_wfile_jumps);
-  _IO_JUMPS (&new_f->fp) = &_IO_file_jumps;
-  _IO_file_init (&new_f->fp.file);
+  _IO_JUMPS (new_f) = &_IO_file_jumps;
+  _IO_file_init ((_IO_FILE *) new_f);
 #if  !_IO_UNIFIED_JUMPTABLES
   new_f->fp.vtable = NULL;
 #endif
@@ -140,7 +140,7 @@ _IO_new_fdopen (fd, mode)
     _IO_mask_flags (&new_f->fp.file, read_write,
 		    _IO_NO_READS+_IO_NO_WRITES+_IO_IS_APPENDING);
 
-  return &new_f->fp.file;
+  return (_IO_FILE *) new_f;
 }
 
 strong_alias (_IO_new_fdopen, __new_fdopen)
Index: libio/iofopen.c
===================================================================
RCS file: /cvs/glibc/libc/libio/iofopen.c,v
retrieving revision 1.14
diff -u -p -r1.14 iofopen.c
--- iofopen.c	2000/03/21 23:06:40	1.14
+++ iofopen.c	2000/06/27 17:47:36
@@ -49,13 +49,13 @@ _IO_new_fopen (filename, mode)
   new_f->fp.file._lock = &new_f->lock;
 #endif
   _IO_no_init (&new_f->fp.file, 0, 0, &new_f->wd, &_IO_wfile_jumps);
-  _IO_JUMPS (&new_f->fp) = &_IO_file_jumps;
-  _IO_file_init (&new_f->fp.file);
+  _IO_JUMPS (new_f) = &_IO_file_jumps;
+  _IO_file_init ((_IO_FILE *) new_f);
 #if  !_IO_UNIFIED_JUMPTABLES
   new_f->fp.vtable = NULL;
 #endif
-  if (_IO_file_fopen (&new_f->fp.file, filename, mode, 1) != NULL)
-    return (_IO_FILE *) &new_f->fp;
+  if (_IO_file_fopen ((_IO_FILE *) new_f, filename, mode, 1) != NULL)
+    return (_IO_FILE *) new_f;
   _IO_un_link (&new_f->fp.file);
   free (new_f);
   return NULL;
Index: libio/iofopen64.c
===================================================================
RCS file: /cvs/glibc/libc/libio/iofopen64.c,v
retrieving revision 1.7
diff -u -p -r1.7 iofopen64.c
--- iofopen64.c	1999/06/16 21:32:32	1.7
+++ iofopen64.c	2000/06/27 17:47:36
@@ -1,4 +1,4 @@
-/* Copyright (C) 1993, 1997, 1999 Free Software Foundation, Inc.
+/* Copyright (C) 1993, 1997, 1999, 2000 Free Software Foundation, Inc.
    This file is part of the GNU IO Library.
 
    This library is free software; you can redistribute it and/or
@@ -49,13 +49,13 @@ _IO_fopen64 (filename, mode)
   new_f->fp.file._lock = &new_f->lock;
 #endif
   _IO_no_init (&new_f->fp.file, 0, 0, &new_f->wd, &_IO_wfile_jumps);
-  _IO_JUMPS (&new_f->fp) = &_IO_file_jumps;
-  _IO_file_init (&new_f->fp.file);
+  _IO_JUMPS (new_f) = &_IO_file_jumps;
+  _IO_file_init ((_IO_FILE *) new_f);
 #if  !_IO_UNIFIED_JUMPTABLES
   new_f->fp.vtable = NULL;
 #endif
-  if (_IO_file_fopen (&new_f->fp.file, filename, mode, 0) != NULL)
-    return &new_f->fp.file;
+  if (_IO_file_fopen ((_IO_FILE *) new_f, filename, mode, 0) != NULL)
+    return (_IO_FILE *) new_f;
   _IO_un_link (&new_f->fp.file);
   free (new_f);
   return NULL;
Index: libio/iofopncook.c
===================================================================
RCS file: /cvs/glibc/libc/libio/iofopncook.c,v
retrieving revision 1.14
diff -u -p -r1.14 iofopncook.c
--- iofopncook.c	2000/05/21 15:39:12	1.14
+++ iofopncook.c	2000/06/27 17:47:36
@@ -181,7 +181,7 @@ _IO_fopencookie (cookie, mode, io_functi
 
   _IO_cookie_init (&new_f->cfile, read_write, cookie, io_functions);
 
-  return &new_f->cfile.__file;
+  return (_IO_FILE *) new_f;
 }
 
 versioned_symbol (libc, _IO_fopencookie, fopencookie, GLIBC_2_2);
Index: libio/iopopen.c
===================================================================
RCS file: /cvs/glibc/libc/libio/iopopen.c,v
retrieving revision 1.21
diff -u -p -r1.21 iopopen.c
--- iopopen.c	2000/04/12 20:44:12	1.21
+++ iopopen.c	2000/06/27 17:47:36
@@ -203,13 +203,13 @@ _IO_new_popen (command, mode)
 #endif
   fp = &new_f->fpx.file.file;
   _IO_no_init (fp, 0, 0, &new_f->wd, &_IO_wproc_jumps);
-  _IO_JUMPS (fp) = &_IO_proc_jumps;
-  _IO_new_file_init (fp);
+  _IO_JUMPS (new_f) = &_IO_proc_jumps;
+  _IO_new_file_init ((_IO_FILE *) new_f);
 #if  !_IO_UNIFIED_JUMPTABLES
   new_f->fpx.file.vtable = NULL;
 #endif
   if (_IO_new_proc_open (fp, command, mode) != NULL)
-    return fp;
+    return (_IO_FILE *) new_f;
   _IO_un_link (fp);
   free (new_f);
   return NULL;
Index: libio/iovdprintf.c
===================================================================
RCS file: /cvs/glibc/libc/libio/iovdprintf.c,v
retrieving revision 1.6
diff -u -p -r1.6 iovdprintf.c
--- iovdprintf.c	1999/06/16 21:49:49	1.6
+++ iovdprintf.c	2000/06/27 17:47:36
@@ -1,4 +1,4 @@
-/* Copyright (C) 1995, 1997, 1998, 1999 Free Software Foundation, Inc.
+/* Copyright (C) 1995, 1997, 1998, 1999, 2000 Free Software Foundation, Inc.
    This file is part of the GNU IO Library.
 
    This library is free software; you can redistribute it and/or
@@ -43,8 +43,8 @@ _IO_vdprintf (d, format, arg)
   tmpfil.file._lock = &lock;
 #endif
   _IO_no_init (&tmpfil.file, 0, 0, &wd, &_IO_wfile_jumps);
-  _IO_JUMPS (&tmpfil.file) = &_IO_file_jumps;
-  _IO_file_init (&tmpfil.file);
+  _IO_JUMPS (&tmpfil) = &_IO_file_jumps;
+  _IO_file_init ((_IO_FILE *) &tmpfil);
 #if  !_IO_UNIFIED_JUMPTABLES
   tmpfil.vtable = NULL;
 #endif
@@ -58,7 +58,7 @@ _IO_vdprintf (d, format, arg)
 		     _IO_NO_READS+_IO_NO_WRITES+_IO_IS_APPENDING)
      | _IO_DELETE_DONT_CLOSE);
 
-  done = _IO_vfprintf (&tmpfil.file, format, arg);
+  done = _IO_vfprintf ((_IO_FILE *) &tmpfil, format, arg);
 
   _IO_FINISH (&tmpfil.file);
 
Index: libio/iovsprintf.c
===================================================================
RCS file: /cvs/glibc/libc/libio/iovsprintf.c,v
retrieving revision 1.13
diff -u -p -r1.13 iovsprintf.c
--- iovsprintf.c	1999/06/16 21:49:51	1.13
+++ iovsprintf.c	2000/06/27 17:47:36
@@ -1,4 +1,4 @@
-/* Copyright (C) 1993, 1997, 1998, 1999 Free Software Foundation, Inc.
+/* Copyright (C) 1993, 1997, 1998, 1999, 2000 Free Software Foundation, Inc.
    This file is part of the GNU IO Library.
 
    This library is free software; you can redistribute it and/or
@@ -42,9 +42,9 @@ _IO_vsprintf (string, format, args)
   sf._sbf._f._lock = &lock;
 #endif
   _IO_no_init (&sf._sbf._f, 0, -1, NULL, NULL);
-  _IO_JUMPS (&sf._sbf._f) = &_IO_str_jumps;
-  _IO_str_init_static (&sf._sbf._f, string, -1, string);
-  ret = _IO_vfprintf (&sf._sbf._f, format, args);
+  _IO_JUMPS (&sf) = &_IO_str_jumps;
+  _IO_str_init_static ((_IO_FILE *) &sf, string, -1, string);
+  ret = _IO_vfprintf ((_IO_FILE *) &sf, format, args);
   _IO_putc_unlocked ('\0', &sf._sbf._f);
   return ret;
 }
Index: libio/iovsscanf.c
===================================================================
RCS file: /cvs/glibc/libc/libio/iovsscanf.c,v
retrieving revision 1.15
diff -u -p -r1.15 iovsscanf.c
--- iovsscanf.c	1999/06/16 21:49:52	1.15
+++ iovsscanf.c	2000/06/27 17:47:36
@@ -1,4 +1,4 @@
-/* Copyright (C) 1993, 1997, 1998, 1999 Free Software Foundation, Inc.
+/* Copyright (C) 1993, 1997, 1998, 1999, 2000 Free Software Foundation, Inc.
    This file is part of the GNU IO Library.
 
    This library is free software; you can redistribute it and/or
@@ -39,9 +39,9 @@ _IO_vsscanf (string, format, args)
   sf._sbf._f._lock = &lock;
 #endif
   _IO_no_init (&sf._sbf._f, 0, -1, NULL, NULL);
-  _IO_JUMPS (&sf._sbf._f) = &_IO_str_jumps;
+  _IO_JUMPS (&sf) = &_IO_str_jumps;
   _IO_str_init_static (&sf._sbf._f, (char*)string, 0, NULL);
-  ret = _IO_vfscanf (&sf._sbf._f, format, args, NULL);
+  ret = _IO_vfscanf ((_IO_FILE *) &sf, format, args, NULL);
   return ret;
 }
 
Index: libio/memstream.c
===================================================================
RCS file: /cvs/glibc/libc/libio/memstream.c,v
retrieving revision 1.11
diff -u -p -r1.11 memstream.c
--- memstream.c	1999/06/16 21:55:02	1.11
+++ memstream.c	2000/06/27 17:47:36
@@ -1,4 +1,4 @@
-/* Copyright (C) 1995, 1996, 1997, 1999 Free Software Foundation, Inc.
+/* Copyright (C) 1995, 1996, 1997, 1999, 2000 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -113,7 +113,7 @@ open_memstream (bufloc, sizeloc)
   if (buf == NULL)
     return NULL;
   _IO_no_init (&new_f->fp._sf._sbf._f, 0, 0, &new_f->wd, &_IO_wmem_jumps);
-  _IO_JUMPS (&new_f->fp._sf._sbf._f) = &_IO_mem_jumps;
+  _IO_JUMPS (new_f) = &_IO_mem_jumps;
   _IO_str_init_static (&new_f->fp._sf._sbf._f, buf, _IO_BUFSIZ, buf);
   new_f->fp._sf._sbf._f._flags &= ~_IO_USER_BUF;
   new_f->fp._sf._s._allocate_buffer = (_IO_alloc_type) malloc;
@@ -122,7 +122,7 @@ open_memstream (bufloc, sizeloc)
   new_f->fp.bufloc = bufloc;
   new_f->fp.sizeloc = sizeloc;
 
-  return &new_f->fp._sf._sbf._f;
+  return (_IO_FILE *) new_f;
 }
 
 
Index: libio/obprintf.c
===================================================================
RCS file: /cvs/glibc/libc/libio/obprintf.c,v
retrieving revision 1.8
diff -u -p -r1.8 obprintf.c
--- obprintf.c	2000/06/27 16:08:27	1.8
+++ obprintf.c	2000/06/27 17:47:36
@@ -136,7 +136,7 @@ _IO_obstack_vprintf (struct obstack *obs
 #endif
 
   _IO_no_init (&new_f.ofile.file.file, 0, -1, NULL, NULL);
-  _IO_JUMPS (&new_f.ofile.file) = &_IO_obstack_jumps;
+  _IO_JUMPS (&new_f) = &_IO_obstack_jumps;
   room = obstack_room (obstack);
   size = obstack_object_size (obstack) + room;
   if (size == 0)
@@ -167,7 +167,7 @@ _IO_obstack_vprintf (struct obstack *obs
 
   new_f.ofile.obstack = obstack;
 
-  result = _IO_vfprintf (&new_f.ofile.file.file, format, args);
+  result = _IO_vfprintf ((_IO_FILE *) &new_f, format, args);
 
   /* Shrink the buffer to the space we really currently need.  */
   obstack_blank_fast (obstack, (new_f.ofile.file.file._IO_write_ptr
Index: libio/oldiofdopen.c
===================================================================
RCS file: /cvs/glibc/libc/libio/oldiofdopen.c,v
retrieving revision 1.4
diff -u -p -r1.4 oldiofdopen.c
--- oldiofdopen.c	2000/03/27 05:18:31	1.4
+++ oldiofdopen.c	2000/06/27 17:47:36
@@ -113,8 +113,8 @@ _IO_old_fdopen (fd, mode)
   new_f->fp.file._lock = &new_f->lock;
 #endif
   _IO_init (&new_f->fp.file, 0);
-  _IO_JUMPS (&new_f->fp) = &_IO_old_file_jumps;
-  _IO_old_file_init (&new_f->fp.file);
+  _IO_JUMPS (new_f) = &_IO_old_file_jumps;
+  _IO_old_file_init ((_IO_FILE *) new_f);
 #if  !_IO_UNIFIED_JUMPTABLES
   new_f->fp.vtable = NULL;
 #endif
@@ -130,7 +130,7 @@ _IO_old_fdopen (fd, mode)
     _IO_mask_flags (&new_f->fp.file, read_write,
 		    _IO_NO_READS+_IO_NO_WRITES+_IO_IS_APPENDING);
 
-  return &new_f->fp.file;
+  return (_IO_FILE *) new_f;
 }
 
 strong_alias (_IO_old_fdopen, __old_fdopen)
Index: libio/oldiofopen.c
===================================================================
RCS file: /cvs/glibc/libc/libio/oldiofopen.c,v
retrieving revision 1.7
diff -u -p -r1.7 oldiofopen.c
--- oldiofopen.c	2000/03/27 05:18:31	1.7
+++ oldiofopen.c	2000/06/27 17:47:36
@@ -52,13 +52,13 @@ _IO_old_fopen (filename, mode)
   new_f->fp.file._lock = &new_f->lock;
 #endif
   _IO_init (&new_f->fp.file, 0);
-  _IO_JUMPS (&new_f->fp.file) = &_IO_old_file_jumps;
-  _IO_old_file_init (&new_f->fp.file);
+  _IO_JUMPS (new_f) = &_IO_old_file_jumps;
+  _IO_old_file_init ((_IO_FILE *) new_f);
 #if  !_IO_UNIFIED_JUMPTABLES
   new_f->fp.vtable = NULL;
 #endif
-  if (_IO_old_file_fopen (&new_f->fp.file, filename, mode) != NULL)
-        return &new_f->fp.file;
+  if (_IO_old_file_fopen ((_IO_FILE *) new_f, filename, mode) != NULL)
+    return (_IO_FILE *) new_f;
   _IO_un_link (&new_f->fp.file);
   free (new_f);
   return NULL;
Index: libio/oldiopopen.c
===================================================================
RCS file: /cvs/glibc/libc/libio/oldiopopen.c,v
retrieving revision 1.5
diff -u -p -r1.5 oldiopopen.c
--- oldiopopen.c	2000/04/12 20:44:43	1.5
+++ oldiopopen.c	2000/06/27 17:47:36
@@ -203,8 +203,8 @@ _IO_old_popen (command, mode)
 #endif
   fp = &new_f->fpx.file.file;
   _IO_init (fp, 0);
-  _IO_JUMPS (fp) = &_IO_old_proc_jumps;
-  _IO_old_file_init (fp);
+  _IO_JUMPS (new_f) = &_IO_old_proc_jumps;
+  _IO_old_file_init ((_IO_FILE *) new_f);
 #if  !_IO_UNIFIED_JUMPTABLES
   new_f->fpx.file.vtable = NULL;
 #endif
Index: libio/oldstdfiles.c
===================================================================
RCS file: /cvs/glibc/libc/libio/oldstdfiles.c,v
retrieving revision 1.7
diff -u -p -r1.7 oldstdfiles.c
--- oldstdfiles.c	2000/03/27 05:18:31	1.7
+++ oldstdfiles.c	2000/06/27 17:47:37
@@ -48,8 +48,8 @@
 #endif
 
 DEF_STDFILE(_IO_stdin_, 0, 0, _IO_NO_WRITES);
-DEF_STDFILE(_IO_stdout_, 1, &_IO_stdin_.file, _IO_NO_READS);
-DEF_STDFILE(_IO_stderr_, 2, &_IO_stdout_.file,
+DEF_STDFILE(_IO_stdout_, 1, (_IO_FILE *) &_IO_stdin_, _IO_NO_READS);
+DEF_STDFILE(_IO_stderr_, 2, (_IO_FILE *) &_IO_stdout_,
 	    _IO_NO_READS+_IO_UNBUFFERED);
 
 #if defined __GNUC__ && __GNUC__ >= 2
@@ -81,9 +81,10 @@ _IO_check_libio ()
   if (&_IO_stdin_used == NULL)
     {
       /* We are using the old one. */
-      _IO_stdin = stdin = &_IO_stdin_.file;
-      _IO_stdout = stdout = &_IO_stdout_.file;
-      _IO_stderr = stderr = _IO_list_all = &_IO_stderr_.file;
+      _IO_stdin = stdin = (_IO_FILE *) &_IO_stdin_;
+      _IO_stdout = stdout = (_IO_FILE *) &_IO_stdout_;
+      _IO_stderr = stderr = (_IO_FILE *) &_IO_stderr_;
+      _IO_list_all = (_IO_FILE *) &_IO_stderr_;
       _IO_stdin->_vtable_offset = _IO_stdout->_vtable_offset =
 	_IO_stderr->_vtable_offset = stdin->_vtable_offset =
 	stdout->_vtable_offset = stderr->_vtable_offset =
Index: libio/stdfiles.c
===================================================================
RCS file: /cvs/glibc/libc/libio/stdfiles.c,v
retrieving revision 1.12
diff -u -p -r1.12 stdfiles.c
--- stdfiles.c	1999/06/16 21:57:43	1.12
+++ stdfiles.c	2000/06/27 17:47:37
@@ -1,4 +1,4 @@
-/* Copyright (C) 1993, 1994, 1996, 1997, 1999 Free Software Foundation, Inc.
+/* Copyright (C) 1993, 1994, 1996, 1997, 1999, 2000 Free Software Foundation, Inc.
    This file is part of the GNU IO Library.
 
    This library is free software; you can redistribute it and/or
@@ -50,8 +50,8 @@
 #endif
 
 DEF_STDFILE(_IO_2_1_stdin_, 0, 0, _IO_NO_WRITES);
-DEF_STDFILE(_IO_2_1_stdout_, 1, &_IO_2_1_stdin_.file, _IO_NO_READS);
-DEF_STDFILE(_IO_2_1_stderr_, 2, &_IO_2_1_stdout_.file,
+DEF_STDFILE(_IO_2_1_stdout_, 1, (_IO_FILE *) &_IO_2_1_stdin_, _IO_NO_READS);
+DEF_STDFILE(_IO_2_1_stderr_, 2, (_IO_FILE *) &_IO_2_1_stdout_,
             _IO_NO_READS+_IO_UNBUFFERED);
 
-_IO_FILE *_IO_list_all = &_IO_2_1_stderr_.file;
+_IO_FILE *_IO_list_all = (_IO_FILE *) &_IO_2_1_stderr_;
Index: libio/stdio.c
===================================================================
RCS file: /cvs/glibc/libc/libio/stdio.c,v
retrieving revision 1.6
diff -u -p -r1.6 stdio.c
--- stdio.c	1997/12/14 21:38:42	1.6
+++ stdio.c	2000/06/27 17:47:37
@@ -1,4 +1,4 @@
-/* Copyright (C) 1993, 1994, 1996, 1997 Free Software Foundation, Inc.
+/* Copyright (C) 1993, 1994, 1996, 1997, 2000 Free Software Foundation, Inc.
    This file is part of the GNU IO Library.
 
    This library is free software; you can redistribute it and/or
@@ -29,9 +29,9 @@
 #undef stdin
 #undef stdout
 #undef stderr
-FILE *stdin = &_IO_2_1_stdin_.file;
-FILE *stdout = &_IO_2_1_stdout_.file;
-FILE *stderr = &_IO_2_1_stderr_.file;
+FILE *stdin = (FILE *) &_IO_2_1_stdin_;
+FILE *stdout = (FILE *) &_IO_2_1_stdout_;
+FILE *stderr = (FILE *) &_IO_2_1_stderr_;
 
 #undef _IO_stdin
 #undef _IO_stdout
Index: libio/vsnprintf.c
===================================================================
RCS file: /cvs/glibc/libc/libio/vsnprintf.c,v
retrieving revision 1.12
diff -u -p -r1.12 vsnprintf.c
--- vsnprintf.c	1999/08/19 16:39:05	1.12
+++ vsnprintf.c	2000/06/27 17:47:37
@@ -1,4 +1,4 @@
-/* Copyright (C) 1994, 1997, 1999 Free Software Foundation, Inc.
+/* Copyright (C) 1994, 1997, 1999, 2000 Free Software Foundation, Inc.
    This file is part of the GNU IO Library.
 
    This library is free software; you can redistribute it and/or
@@ -123,7 +123,7 @@ _IO_vsnprintf (string, maxlen, format, a
     }
 
   _IO_no_init (&sf.f._sbf._f, 0, -1, NULL, NULL);
-  _IO_JUMPS (&sf.f._sbf._f) = &_IO_strn_jumps;
+  _IO_JUMPS (&sf) = &_IO_strn_jumps;
   string[0] = '\0';
   _IO_str_init_static (&sf.f._sbf._f, string, maxlen - 1, string);
   ret = _IO_vfprintf (&sf.f._sbf._f, format, args);
Index: stdio-common/vfprintf.c
===================================================================
RCS file: /cvs/glibc/libc/stdio-common/vfprintf.c,v
retrieving revision 1.82
diff -u -p -r1.82 vfprintf.c
--- vfprintf.c	2000/06/17 19:02:41	1.82
+++ vfprintf.c	2000/06/27 17:47:38
@@ -30,6 +30,8 @@
 #include "_i18n_itoa.h"
 #include <locale/localeinfo.h>
 
+#include <bp-checks.h>
+
 /* This code is shared between the standard stdio implementation found
    in GNU C library and the libio implementation originally found in
    GNU libg++.
@@ -310,7 +312,7 @@ vfprintf (FILE *s, const CHAR_T *format,
       do								      \
 	{								      \
 	  int offset;							      \
-	  void *ptr;							      \
+	  void *__unbounded ptr;					      \
 	  spec = (ChExpr);						      \
 	  offset = NOT_IN_JUMP_RANGE (spec) ? REF (form_unknown)	      \
 	    : table[CHAR_CLASS (spec)];					      \
@@ -323,7 +325,7 @@ vfprintf (FILE *s, const CHAR_T *format,
 # define JUMP(ChExpr, table)						      \
       do								      \
 	{								      \
-	  const void *ptr;						      \
+	  const void *__unbounded ptr;					      \
 	  spec = (ChExpr);						      \
 	  ptr = NOT_IN_JUMP_RANGE (spec) ? REF (form_unknown)		      \
 	    : table[CHAR_CLASS (spec)];					      \
@@ -1971,7 +1973,7 @@ buffered_vfprintf (register _IO_FILE *s,
 {
   CHAR_T buf[_IO_BUFSIZ];
   struct helper_file helper;
-  register _IO_FILE *hp = &helper._f.file;
+  register _IO_FILE *hp = (_IO_FILE *) &helper._f;
   int result, to_flush;
 
   /* Initialize helper.  */
@@ -1991,7 +1993,7 @@ buffered_vfprintf (register _IO_FILE *s,
   hp->_lock = &helper.lock;
   __libc_lock_init (*hp->_lock);
 #endif
-  _IO_JUMPS (hp) = (struct _IO_jump_t *) &_IO_helper_jumps;
+  _IO_JUMPS (&helper) = (struct _IO_jump_t *) &_IO_helper_jumps;
 
   /* Now print to helper instead.  */
   result = vfprintf (hp, format, args);