[patch] Fix for heap overflow in wscanf (BZ 16618)

[Andreas Schwab]

Paul Pluzhnikov <ppluzhnikov@google.com> writes:

> diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c
> index cd129a8..fb0a601 100644
> --- a/stdio-common/vfscanf.c
> +++ b/stdio-common/vfscanf.c
> @@ -274,14 +274,24 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
>  	  CHAR_T *old = wp;						    \
>  	  size_t newsize = (UCHAR_MAX + 1 > 2 * wpmax			    \
>  			    ? UCHAR_MAX + 1 : 2 * wpmax);		    \
> -	  if (use_malloc || !__libc_use_alloca (newsize))		    \
> +	  if (__glibc_unlikely (wpmax > SIZE_MAX / 2)			    \
> +	      || __glibc_unlikely (newsize > SIZE_MAX / sizeof (CHAR_T)))   \
>  	    {								    \
> -	      wp = realloc (use_malloc ? wp : NULL, newsize);		    \
> +	      if (use_malloc)						    \
> +	    	free (old);						    \
> +	      done = EOF;						    \
> +	      __set_errno (ENOMEM);					    \
> +	      goto errout;						    \
> +	    }								    \
> +	  if (use_malloc || !__libc_use_alloca (newsize * sizeof (CHAR_T))) \
> +	    {								    \
> +	      wp = realloc (use_malloc ? wp : NULL, newsize * sizeof (CHAR_T));	\
>  	      if (wp == NULL)						    \
>  		{							    \
>  		  if (use_malloc)					    \
>  		    free (old);						    \
>  		  done = EOF;						    \
> +		  __set_errno (ENOMEM);					    \

You already have a meaningful errno from the failed realloc.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."