[Bug stdio/34086] New: stdio-common: register_printf_modifier may lead to heap overflow

[marocketbd at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=34086

            Bug ID: 34086
           Summary: stdio-common: register_printf_modifier may lead to
                    heap overflow
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: marocketbd at gmail dot com
  Target Milestone: ---
             Flags: security?

register_printf_modifier is a API that only GNU implemented it, is written in
2009 and has a documentation with "TODO". It accepts a wide string, and ensure
every wchar in it must be lower or equal than UCHAR_MAX. However, the
__printf_modifier_table is only allocated with UCHAR_MAX elements. So when user
register modifier like L"\xff", the line below will overflow one element out of
heap, leading to memory corruption.

// stdio-common/reg-modifier.c#L87
__printf_modifier_table[(unsigned char) *str] = newp;

Here is a poc:

---

#include <stdlib.h>
#include <printf.h>

int main(void) {
    void *p = malloc(0x7f0);
    void *p1 = malloc(0);
    free(p);
    register_printf_modifier(L"\xff");
    free(p1);
    return 0;
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.