Bug 14231 - stdio-common tests memory requirements
Summary: stdio-common tests memory requirements
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: stdio (show other bugs)
Version: 2.15
: P2 normal
Target Milestone: 2.32
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-06-13 19:00 UTC by Joseph Myers
Modified: 2020-07-07 14:56 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Joseph Myers 2012-06-13 19:00:25 UTC
The tests stdio-common/test-vfprintf and stdio-common/bug22 fail if the memory available is limited (e.g. 200MB).  This can be reproduced on a system with more memory by:

ulimit -d 200000
ulimit -m 200000
ulimit -v 200000

before running the tests (tested x86_64).

In the test-vfprintf case, test-vfprintf.out contains

file size incorrect for locale C: 99999 instead of 100004
file size incorrect for locale de_DE.ISO-8859-1: 99999 instead of 100004
file size incorrect for locale de_DE.UTF-8: 99999 instead of 100004
file size incorrect for locale ja_JP.EUC-JP: 99999 instead of 100004

and for bug22, bug22.out contains

ret = -1
ret = -1
ret = -1
ret = -1

In general the testsuite tries to limit failures to those showing actual problems with glibc functionality that would be expected to work on the given architecture - for example, by testing for functions that may fail with ENOSYS on some systems and exiting tests early and successfully in those cases.  (Ideally such tests would have an UNRESOLVED or UNSUPPORTED result different from PASS and FAIL, but the testsuite doesn't support that.)  I think the same should apply to allocation failures in these tests that involve stdio code allocating large amounts of memory: the tests should exit successfully in that case.
Comment 1 Joseph Myers 2020-07-07 14:56:19 UTC
Fixed for 2.32, by eliminating the large memory allocations.

commit 6caddd34bd7ffb5ac4f36c8e036eee100c2cc535
Author: Joseph Myers <joseph@codesourcery.com>
Date:   Tue Jul 7 14:54:12 2020 +0000

    Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211).
    
    The vfprintf implementation (used for all printf-family functions)
    contains complicated logic to allocate internal buffers of a size
    depending on the width and precision used for a format, using either
    malloc or alloca depending on that size, and with consequent checks
    for size overflow and allocation failure.
    
    As noted in bug 26211, the version of that logic used when '$' plus
    argument number formats are in use is missing the overflow checks,
    which can result in segfaults (quite possibly exploitable, I didn't
    try to work that out) when the width or precision is in the range
    0x7fffffe0 through 0x7fffffff (maybe smaller values as well in the
    wprintf case on 32-bit systems, when the multiplication by sizeof
    (CHAR_T) can overflow).
    
    All that complicated logic in fact appears to be useless.  As far as I
    can tell, there has been no need (outside the floating-point printf
    code, which does its own allocations) for allocations depending on
    width or precision since commit
    3e95f6602b226e0de06aaff686dc47b282d7cc16 ("Remove limitation on size
    of precision for integers", Sun Sep 12 21:23:32 1999 +0000).  Thus,
    this patch removes that logic completely, thereby fixing both problems
    with excessive allocations for large width and precision for
    non-floating-point formats, and the problem with missing overflow
    checks with such allocations.  Note that this does have the
    consequence that width and precision up to INT_MAX are now allowed
    where previously INT_MAX / sizeof (CHAR_T) - EXTSIZ or more would have
    been rejected, so could potentially expose any other overflows where
    the value would previously have been rejected by those removed checks.
    
    I believe this completely fixes bugs 14231 and 26211.
    
    Excessive allocations are still possible in the floating-point case
    (bug 21127), as are other integer or buffer overflows (see bug 26201).
    This does not address the cases where a precision larger than INT_MAX
    (embedded in the format string) would be meaningful without printf's
    return value overflowing (when it's used with a string format, or %g
    without the '#' flag, so the actual output will be much smaller), as
    mentioned in bug 17829 comment 8; using size_t internally for
    precision to handle that case would be complicated by struct
    printf_info being a public ABI.  Nor does it address the matter of an
    INT_MIN width being negated (bug 17829 comment 7; the same logic
    appears a second time in the file as well, in the form of multiplying
    by -1).  There may be other sources of memory allocations with malloc
    in printf functions as well (bug 24988, bug 16060).  From inspection,
    I think there are also integer overflows in two copies of "if ((width
    -= len) < 0)" logic (where width is int, len is size_t and a very long
    string could result in spurious padding being output on a 32-bit
    system before printf overflows the count of output characters).
    
    Tested for x86-64 and x86.