[PATCH v2] vfprintf stack overflow [BZ #16617]

[Florian Weimer]

On 12/08/2014 04:41 PM, Joseph Myers wrote:
> On Mon, 8 Dec 2014, Florian Weimer wrote:
>
>> +		specs = malloc (nspecs_size);
>> +		if (specs == NULL)
>> +		  {
>> +		    __set_errno (ENOMEM);
>> +		    done = -1;
>> +		    goto all_done;
>> +		  }
>
> It looks to me like this will leak the previous copy of specs on
> allocation failure, if the previous value was also malloced (so you need
> "specs = old;" or similar here to get the return path to free it if
> appropriate).

Ugh, thanks, I've made that change.  Anything else?

-- 
Florian Weimer / Red Hat Product Security
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-CVE-2012-3406-Stack-overflow-in-vfprintf-BZ-16617.patch
Type: text/x-patch
Size: 9277 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20141208/ace57ee4/attachment.bin>