Bug 15441 - _nl_find_msg: Failure to check for NULL, and callers failing to handle -1 return value.
Summary: _nl_find_msg: Failure to check for NULL, and callers failing to handle -1 ret...
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
Depends on:
Reported: 2013-05-07 18:52 UTC by Carlos O'Donell
Modified: 2014-06-13 18:07 UTC (History)
1 user (show)

See Also:
Last reconfirmed:
fweimer: security-


Note You need to log in before you can comment on or make changes to this bug.
Description Carlos O'Donell 2013-05-07 18:52:58 UTC
This commit:
commit 006dd86111c44572dbd3b26e9c63dd0f834d7762
Author: Jeff Law <law at redhat.com>
Date:   Thu Jun 21 17:15:38 2012 -0600

            [BZ #14277]
            * intl/dcigettext.c (_nl_find_msg): Avoid use after potential
            free.  Simplify list management for _LIBC case.

Fails to check malloc's return in intl/dcigettext.c (_nl_find_msg):
 		      freemem_size = INITIAL_BLOCK_SIZE;
 		      newmem = (transmem_block_t *) malloc (freemem_size);
 # ifdef _LIBC
		      /* Add the block to the list of blocks we have to free
			 at some point.  */
		      newmem->next = transmem_list;
		      transmem_list = newmem;
If malloc fails then newmem is NULL then newmem->next results in a fault.
The fix is easy enough, check for newmem != NULL, and fall through to
the error condition below which returns (char *) -1 e.g. resource error.

The problem is that returning (char *) -1  will break all sorts of other
callers, so while what we did is correct, the real failure case fix is slightly
Comment 1 Carlos O'Donell 2013-05-07 18:53:36 UTC
Patch posted:
Comment 2 Carlos O'Donell 2013-05-22 18:49:33 UTC
Upstream gnu gettext bug submitted:
Comment 3 Carlos O'Donell 2013-05-22 18:56:47 UTC
Fixed by:

commit 7a44c18fb4b1a65ebb1fece0b0d04f2570ed4d82
Author: Carlos O'Donell <carlos@redhat.com>
Date:   Wed May 22 14:50:26 2013 -0400

    Fix _nl_find_msg malloc failure case, and callers.