[PATCH] vfprint: validate nargs and argument-based offsets

[Kees Cook]

Hi Tomas,

On Mon, Mar 05, 2012 at 06:09:23PM +0100, Tomas Hoger wrote:
> On Fri, 2 Mar 2012 10:53:46 -0800 Kees Cook wrote:
> 
> > The nargs value can overflow when doing allocations, allowing
> > arbitrary memory writes via format strings, bypassing _FORTIFY_SOURCE:
> > http://www.phrack.org/issues.html?issue=67&id=9
> > 
> > This checks for nargs overflow and possibly allocates from heap
> > instead of stack, and adds a regression test for the situation.
> 
> A commenter in Red Hat bugzilla proposed different fix:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=794766#c8
> 
>   The easiest fix would have been to restrict "nargs" to NL_ARGMAX.
> 
>   http://www.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html#tag_13_23_03_07
> 
> which has the benefit of avoiding possibly large heap allocation in the
> bad case.  Kees, have you considered such approach?

I have no problem with this. I opted against it originally since it seemed
like a needless limit to nargs when other options for handling it existed.

That said, it's a much simpler fix. :) Would anyone else prefer it over
the current fix?

-Kees

-- 
Kees Cook                                            @outflux.net