[PATCH] vfprint: validate nargs and argument-based offsets

[Tomas Hoger]

On Fri, 2 Mar 2012 10:53:46 -0800 Kees Cook wrote:

> The nargs value can overflow when doing allocations, allowing
> arbitrary memory writes via format strings, bypassing _FORTIFY_SOURCE:
> http://www.phrack.org/issues.html?issue=67&id=9
> 
> This checks for nargs overflow and possibly allocates from heap
> instead of stack, and adds a regression test for the situation.

A commenter in Red Hat bugzilla proposed different fix:

https://bugzilla.redhat.com/show_bug.cgi?id=794766#c8

  The easiest fix would have been to restrict "nargs" to NL_ARGMAX.

  http://www.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html#tag_13_23_03_07

which has the benefit of avoiding possibly large heap allocation in the
bad case.  Kees, have you considered such approach?

th.