This is the mail archive of the
glibc-cvs@sourceware.org
mailing list for the glibc project.
GNU C Library master sources branch master updated. glibc-2.20-582-g5bd80bf
- From: carlos at sourceware dot org
- To: glibc-cvs at sourceware dot org
- Date: 6 Feb 2015 05:51:38 -0000
- Subject: GNU C Library master sources branch master updated. glibc-2.20-582-g5bd80bf
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, master has been updated
via 5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06 (commit)
from 04cb913ddf67ac90da274dd32b6ceafd57ca36ca (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06
commit 5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06
Author: Paul Pluzhnikov <ppluzhnikov@google.com>
Date: Fri Feb 6 00:30:42 2015 -0500
CVE-2015-1472: wscanf allocates too little memory
BZ #16618
Under certain conditions wscanf can allocate too little memory for the
to-be-scanned arguments and overflow the allocated buffer. The
implementation now correctly computes the required buffer size when
using malloc.
A regression test was added to tst-sscanf.
diff --git a/ChangeLog b/ChangeLog
index 4916b03..d23d3ae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2015-02-05 Paul Pluzhnikov <ppluzhnikov@google.com>
+
+ [BZ #16618]
+ * stdio-common/tst-sscanf.c (main): Test for buffer overflow.
+ * stdio-common/vfscanf.c (_IO_vfscanf_internal): Compute needed
+ size in bytes. Store needed elements in wpmax. Use needed size
+ in bytes for extend_alloca.
+
2015-02-05 Carlos O'Donell <carlos@systemhalted.org>
* manual/install.texi: Latest tested versions are GCC 4.9.2,
diff --git a/NEWS b/NEWS
index c91b9fc..617cdbb 100644
--- a/NEWS
+++ b/NEWS
@@ -10,15 +10,21 @@ Version 2.21
* The following bugs are resolved with this release:
6652, 10672, 12674, 12847, 12926, 13862, 14132, 14138, 14171, 14498,
- 15215, 15378, 15884, 16009, 16418, 16191, 16469, 16576, 16617, 16619,
- 16657, 16740, 16857, 17192, 17266, 17273, 17344, 17363, 17370, 17371,
- 17411, 17460, 17475, 17485, 17501, 17506, 17508, 17522, 17555, 17570,
- 17571, 17572, 17573, 17574, 17582, 17583, 17584, 17585, 17589, 17594,
- 17601, 17608, 17616, 17625, 17630, 17633, 17634, 17635, 17647, 17653,
- 17657, 17658, 17664, 17665, 17668, 17682, 17702, 17717, 17719, 17722,
- 17723, 17724, 17725, 17732, 17733, 17744, 17745, 17746, 17747, 17748,
- 17775, 17777, 17780, 17781, 17782, 17791, 17793, 17796, 17797, 17801,
- 17803, 17806, 17834, 17844, 17848, 17868, 17869, 17870, 17885, 17892.
+ 15215, 15378, 15884, 16009, 16418, 16191, 16469, 16576, 16617, 16618,
+ 16619, 16657, 16740, 16857, 17192, 17266, 17273, 17344, 17363, 17370,
+ 17371, 17411, 17460, 17475, 17485, 17501, 17506, 17508, 17522, 17555,
+ 17570, 17571, 17572, 17573, 17574, 17582, 17583, 17584, 17585, 17589,
+ 17594, 17601, 17608, 17616, 17625, 17630, 17633, 17634, 17635, 17647,
+ 17653, 17657, 17658, 17664, 17665, 17668, 17682, 17702, 17717, 17719,
+ 17722, 17723, 17724, 17725, 17732, 17733, 17744, 17745, 17746, 17747,
+ 17748, 17775, 17777, 17780, 17781, 17782, 17791, 17793, 17796, 17797,
+ 17801, 17803, 17806, 17834, 17844, 17848, 17868, 17869, 17870, 17885,
+ 17892.
+
+* CVE-2015-1472 Under certain conditions wscanf can allocate too little
+ memory for the to-be-scanned arguments and overflow the allocated
+ buffer. The implementation now correctly computes the required buffer
+ size when using malloc.
* A new semaphore algorithm has been implemented in generic C code for all
machines. Previous custom assembly implementations of semaphore were
diff --git a/stdio-common/tst-sscanf.c b/stdio-common/tst-sscanf.c
index aece3f2..8a2eb9e 100644
--- a/stdio-common/tst-sscanf.c
+++ b/stdio-common/tst-sscanf.c
@@ -233,5 +233,38 @@ main (void)
}
}
+ /* BZ #16618
+ The test will segfault during SSCANF if the buffer overflow
+ is not fixed. The size of `s` is such that it forces the use
+ of malloc internally and this triggers the incorrect computation.
+ Thus the value for SIZE is arbitrariy high enough that malloc
+ is used. */
+ {
+#define SIZE 131072
+ CHAR *s = malloc ((SIZE + 1) * sizeof (*s));
+ if (s == NULL)
+ abort ();
+ for (size_t i = 0; i < SIZE; i++)
+ s[i] = L('0');
+ s[SIZE] = L('\0');
+ int i = 42;
+ /* Scan multi-digit zero into `i`. */
+ if (SSCANF (s, L("%d"), &i) != 1)
+ {
+ printf ("FAIL: bug16618: SSCANF did not read one input item.\n");
+ result = 1;
+ }
+ if (i != 0)
+ {
+ printf ("FAIL: bug16618: Value of `i` was not zero as expected.\n");
+ result = 1;
+ }
+ free (s);
+ if (result != 1)
+ printf ("PASS: bug16618: Did not crash.\n");
+#undef SIZE
+ }
+
+
return result;
}
diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c
index cd129a8..0e204e7 100644
--- a/stdio-common/vfscanf.c
+++ b/stdio-common/vfscanf.c
@@ -272,9 +272,10 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
if (__glibc_unlikely (wpsize == wpmax)) \
{ \
CHAR_T *old = wp; \
- size_t newsize = (UCHAR_MAX + 1 > 2 * wpmax \
- ? UCHAR_MAX + 1 : 2 * wpmax); \
- if (use_malloc || !__libc_use_alloca (newsize)) \
+ bool fits = __glibc_likely (wpmax <= SIZE_MAX / sizeof (CHAR_T) / 2); \
+ size_t wpneed = MAX (UCHAR_MAX + 1, 2 * wpmax); \
+ size_t newsize = fits ? wpneed * sizeof (CHAR_T) : SIZE_MAX; \
+ if (!__libc_use_alloca (newsize)) \
{ \
wp = realloc (use_malloc ? wp : NULL, newsize); \
if (wp == NULL) \
@@ -286,14 +287,13 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
} \
if (! use_malloc) \
MEMCPY (wp, old, wpsize); \
- wpmax = newsize; \
+ wpmax = wpneed; \
use_malloc = true; \
} \
else \
{ \
size_t s = wpmax * sizeof (CHAR_T); \
- wp = (CHAR_T *) extend_alloca (wp, s, \
- newsize * sizeof (CHAR_T)); \
+ wp = (CHAR_T *) extend_alloca (wp, s, newsize); \
wpmax = s / sizeof (CHAR_T); \
if (old != NULL) \
MEMCPY (wp, old, wpsize); \
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 8 ++++++++
NEWS | 24 +++++++++++++++---------
stdio-common/tst-sscanf.c | 33 +++++++++++++++++++++++++++++++++
stdio-common/vfscanf.c | 12 ++++++------
4 files changed, 62 insertions(+), 15 deletions(-)
hooks/post-receive
--
GNU C Library master sources