[Bug libc/14459] strtod integer and buffer overflows

[bugdal at aerifal dot cx]

http://sourceware.org/bugzilla/show_bug.cgi?id=14459

Rich Felker <bugdal at aerifal dot cx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bugdal at aerifal dot cx

--- Comment #1 from Rich Felker <bugdal at aerifal dot cx> 2012-08-13 19:11:52 UTC ---
In general, test cases for giant-string bugs like this can be written so as not
to require a machine with insane amounts of free memory by using mmap cleverly:

1. Make a giant PROT_NONE anonymous mapping of the entire size.
2. Allocate a shared memory object of some reasonable size, e.g. 256k and fill
it with the pattern you want (e.g. all '0').
3. Repeatedly map the object over the original mapping at each offset with
MAP_FIXED|MAP_SHARED.
4. Make new anonymous mappings over top of the parts you want to modify
(usually the head and tail) using MAP_FIXED and fill them with the necessary
data.

This kind of design can take a test case that would otherwise bog most systems
down swapping for several minutes and make it run in a matter of seconds.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.