[PATCH] Unbound alloca in crypt routines

[Marek Polacek]

On Thu, Mar 29, 2012 at 10:55:43AM -0600, Jeff Law wrote:
> 	* crypt/md5-crypt (__md5_crypt_r): Avoid unbounded alloca uses
			^^
Missing ".c".

> 	due to long  keys.
		   ^^
Redundant space.

> @@ -120,7 +121,22 @@ __md5_crypt_r (key, salt, buffer, buflen
>  
>    if ((key - (char *) 0) % __alignof__ (md5_uint32) != 0)
>      {
> -      char *tmp = (char *) alloca (key_len + __alignof__ (md5_uint32));
> +      char *tmp;
> +
> +      /* An attacker could use a very long key to clobber another
> + 	 thread's stack or heap areas.  Punt to malloc if the key is
> +	 long.  Alloca should abolished.  */

Missing word in last sentence?

> +      if (__libc_use_alloca (key_len + __alignof__ (md5_uint32)))
> +	{
> +	  tmp = (char *) alloca (key_len + __alignof__ (md5_uint32));
> +	}

Those { } aren't really necessary here (and in further code).

	Marek