This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]
Other format:	[Raw text]

Re: [patch] Fix for heap overflow in wscanf (BZ 16618)

From: Paul Pluzhnikov <ppluzhnikov at google dot com>
To: Paul Eggert <eggert at cs dot ucla dot edu>
Cc: Andreas Schwab <schwab at suse dot de>, Rich Felker <dalias at libc dot org>, libc-alpha at sourceware dot org
Date: Mon, 2 Feb 2015 11:52:18 -0800
Subject: Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
Authentication-results: sourceware.org; auth=none
References: <CALoOobPgvuBLTk4GzOchr792MHNi1yLgsO5Jqf8MPvY+bk544Q at mail dot gmail dot com> <20150202050906 dot GF23507 at brightrain dot aerifal dot cx> <CALoOobP5yEqB-oKUvPVJm0znonYJ_iM1q_uFBNT2sRojBguJ-A at mail dot gmail dot com> <mvmiofkiqaj dot fsf at hawking dot suse dot de> <CALoOobPyDepfTFp=_y50iKHxAhKV8W+ZkUiV6e-2O=kgpT_08g at mail dot gmail dot com> <54CFCEB1 dot 8090301 at cs dot ucla dot edu>

On Mon, Feb 2, 2015 at 11:23 AM, Paul Eggert <eggert@cs.ucla.edu> wrote:

> So, how about the attached (untested) patch to vfscanf.c instead? It's
> simpler.  It does rely on realloc (wp, SIZE_MAX) returning NULL, but that's
> safe in glibc.

I like it. Re-tested.

Combined patch attached.

Thanks,
-- 
Paul Pluzhnikov

2015-02-02  Paul Eggert  <eggert@cs.ucla.edu>
	    Paul Pluzhnikov  <ppluzhnikov@google.com>

	[BZ #16618]
	* stdio-common/vfscanf.c (ADDW): Correct alloca size check and
	fix heap buffer overflow.
	* stdio-common/tst-sscanf.c: Add test for BZ 16618

Attachment: pr16618.patch6.txt
Description: Text document

Follow-Ups:
- Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Paul Pluzhnikov
- Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Paul Eggert
- Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Carlos O'Donell

References:
- [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Paul Pluzhnikov
- Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Rich Felker
- Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Paul Pluzhnikov
- Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Andreas Schwab
- Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Paul Pluzhnikov
- Re: [patch] Fix for heap overflow in wscanf (BZ 16618)
  - From: Paul Eggert

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]