This is the mail archive of the
glibc-bugs@sourceware.org
mailing list for the glibc project.
[Bug libc/7066] New: Probable buffer overrun in strtold()
- From: "nix at esperi dot org dot uk" <sourceware-bugzilla at sourceware dot org>
- To: glibc-bugs at sources dot redhat dot com
- Date: 4 Dec 2008 00:49:10 -0000
- Subject: [Bug libc/7066] New: Probable buffer overrun in strtold()
- Reply-to: sourceware-bugzilla at sourceware dot org
When testing with the stack-protector patch in #7065, test-strtod is killed by
the stack-protector:
strtod ("12.345") test 0 OK
strtod ("12.345e19") test 1 OK
strtod ("-.1e+9") test 2 OK
strtod (".125") test 3 OK
strtod ("1e20") test 4 OK
strtod ("0e-19") test 5 OK
strtod ("4") test 6 OK
strtod ("5.9e-76") test 7 OK
strtod ("0x1.4p+3") test 8 OK
strtod ("0xAp0") test 9 OK
strtod ("0x0Ap0") test 10 OK
strtod ("0x0A") test 11 OK
strtod ("0xA0") test 12 OK
strtod ("0x0.A0p8") test 13 OK
strtod ("0x0.50p9") test 14 OK
strtod ("0x0.28p10") test 15 OK
strtod ("0x0.14p11") test 16 OK
strtod ("0x0.0A0p12") test 17 OK
strtod ("0x0.050p13") test 18 OK
strtod ("0x0.028p14") test 19 OK
strtod ("0x0.014p15") test 20 OK
strtod ("0x00.00A0p16") test 21 OK
strtod ("0x00.0050p17") test 22 OK
strtod ("0x00.0028p18") test 23 OK
strtod ("0x00.0014p19") test 24 OK
strtod ("0x1p-1023") test 25 OK
strtod ("0x0.8p-1022") test 26 OK
strtod ("Inf") test 27 OK
strtod ("-Inf") test 28 OK
strtod ("+InFiNiTy") test 29 OK
strtod ("0x80000Ap-23") test 30 OK
*** stack smashing detected ***: tst-strtod - terminated
tst-strtod: stack smashing attack in function <unknown> - terminated
tst-strtod: stack smashing attack in function <unknown> - terminated
The backtrace (when linked against -lc_g) is as follows:
#0 0xb80f2424 in __kernel_vsyscall ()
#1 0x0806bc2b in __stack_chk_fail () at stack_chk_fail.c:295
#2 0x08057426 in ____strtold_l_internal (nptr=0x80ae069 "42.", '0' <repeats 19
times>, "1", endptr=0x0, group=0, loc=0x80cc020) at ../stdlib/strtod_l.c:1571
#3 0x080509a7 in strtold (nptr=0x80ae069 "42.", '0' <repeats 19 times>, "1",
endptr=0x0) at strtod.c:70
#4 0x0804863e in main (argc=1, argv=0xbf9f1af4) at tst-strtod.c:168
I'll attach a one-liner to reproduce it as soon as I strip the test down (I
used to have one, but that was six months ago).
--
Summary: Probable buffer overrun in strtold()
Product: glibc
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: libc
AssignedTo: drepper at redhat dot com
ReportedBy: nix at esperi dot org dot uk
CC: glibc-bugs at sources dot redhat dot com
GCC build triplet: i686-pc-linux-gnu
GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu
http://sourceware.org/bugzilla/show_bug.cgi?id=7066
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.