[Bug libc/18240] hcreate((size_t)-1) should fail with ENOMEM

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18240

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security+

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
This is due an integer overflow in __hcreate_r.  It results in out-of-bounds
heap accesses later on when the hash table is used, so we probably should treat
this as a security bug (like the calloc overflow earlier).

-- 
You are receiving this mail because:
You are on the CC list for the bug.