[PATCH] vfprint: validate nargs and argument-based offsets

Roland McGrath roland@hack.frob.com
Wed Feb 1 21:27:00 GMT 2012


> The nargs value can overflow when doing allocations, and argument-based
> offsets are not bounds-checked, allowing arbitrary memory writes via
> format strings, bypassing _FORTIFY_SOURCE protections:
> http://www.phrack.org/issues.html?issue=67&id=9
> 
> This checks for nargs overflow and validates argument-based array offsets.

Seems like a good candidate for adding a test case that demonstrates the
problems.

> +    /* Check for potential integer overflow. */

Two spaces after a period (here and below).


Thanks,
Roland



More information about the Libc-alpha mailing list