This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH] vfprintf stack overflow [BZ #16617]
- From: Rich Felker <dalias at libc dot org>
- To: libc-alpha at sourceware dot org
- Date: Fri, 5 Dec 2014 17:50:10 -0500
- Subject: Re: [PATCH] vfprintf stack overflow [BZ #16617]
- Authentication-results: sourceware.org; auth=none
- References: <5481E0BD dot 9000203 at redhat dot com> <alpine dot DEB dot 2 dot 10 dot 1412051657030 dot 4077 at digraph dot polyomino dot org dot uk> <20141205202639 dot GU4574 at brightrain dot aerifal dot cx> <54822AFD dot 6030407 at cs dot ucla dot edu>
On Fri, Dec 05, 2014 at 02:00:29PM -0800, Paul Eggert wrote:
> On 12/05/2014 12:26 PM, Rich Felker wrote:
> >If N is the size of an actual allocated object, 2*N should not be able
> >to overflow. If it can, it means you already have a situation where an
> >object is so large that legal pointer subtractions overflow ptrdiff_t
> No, because the array elements are of type struct printf_spec, which
> is several bytes in size. So even if the number of bytes in the
> array exceeds PTRDIFF_MAX by a factor of (say) eight, subtracting
> addresses of array elements won't overflow.
>
> Admittedly this is all a bit theoretical.
However the code allocating this object (malloc) didn't know it was
going to be used for an array of printf_spec structs. It could have
been used for an array of char, in which case the dangerous overflow
would be possible.
Rich