[PATCH] vfprint: validate nargs and argument-based offsets
Roland McGrath
roland@hack.frob.com
Wed Feb 1 21:27:00 GMT 2012
> The nargs value can overflow when doing allocations, and argument-based
> offsets are not bounds-checked, allowing arbitrary memory writes via
> format strings, bypassing _FORTIFY_SOURCE protections:
> http://www.phrack.org/issues.html?issue=67&id=9
>
> This checks for nargs overflow and validates argument-based array offsets.
Seems like a good candidate for adding a test case that demonstrates the
problems.
> + /* Check for potential integer overflow. */
Two spaces after a period (here and below).
Thanks,
Roland
More information about the Libc-alpha
mailing list