Bug 968 - Integer overflow in strxfrm_l.c
Summary: Integer overflow in strxfrm_l.c
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.3.5
: P2 normal
Target Milestone: ---
Assignee: GOTO Masanori
URL:
Keywords:
Depends on:
Blocks: 645
  Show dependency tree / graph
 
Reported: 2005-05-24 21:02 UTC by Denis Barbier
Modified: 2005-10-15 20:51 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:

Attachments
Proposed patch to fix loops when backw_stop is 0 (641 bytes, patch)
2005-05-24 21:10 UTC, Denis Barbier 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Denis Barbier 2005-05-24 21:02:10 UTC 
libc/string/strxfrm_l.c contains the following lines:
   /* Handle the pushed elements now.  */
   size_t backw;
   for (backw = idxcnt - 1; backw >= backw_stop; --backw)

If backw_stop is 0. the end test never fails.

This never happens in practice because localedef is broken
(see BZ#645) and stores a single
  order_start forward;forward;forward;forward,position
rule, and hence the backward directive is never processed.
But this bug arises when the patch sent to BZ#645 is applied.
Comment 1 Denis Barbier 2005-05-24 21:10:33 UTC 
Created attachment 495 [details]
Proposed patch to fix loops when backw_stop is 0
Comment 2 Ulrich Drepper 2005-10-15 20:51:36 UTC 
The patch is everything but optimal.  If fixed it differently.