[PATCH] vfprintf: validate nargs and maybe allocate from heap

[Ryan S. Arnold]

On Fri, Mar 2, 2012 at 12:19 PM, Andreas Jaeger <aj@suse.com> wrote:
> On 03/02/2012 05:48 PM, Kees Cook wrote:
>>
>> Hi Andreas,
>>
>> On Fri, Mar 02, 2012 at 04:58:18PM +0100, Andreas Jaeger wrote:
>>>
>>> On 02/16/2012 05:16 PM, Kees Cook wrote:
>>>>
>>>> The nargs value can overflow when doing allocations, allowing arbitrary
>>>> memory writes via format strings, bypassing _FORTIFY_SOURCE:
>>>> http://www.phrack.org/issues.html?issue=67&id=9
>>>
>>>
>>> So a security issue - can we get this fixed quickly, please? I'd
>>> like to ping for a review and commit!
>>
>>
>> Ryan has been trying to make some time for a final testing round, so
>> I'm confident a commit will be coming soon.
>
>
> Ryan, do you see any problems or want specific tests? I just tested on x86
> and x86-64 and think the patch is fine to commit. I can do the commit, just
> tell me what's holding you up...

I don't see any problems.  I verified that an earlier rev of the patch
doesn't regress the printf hooks functionality and wanted to do the
same with the latest revision but that's probably not necessary.  You
may check it in if you'd like.

Ryan