[PATCH] locale: programs: repertoire.c: Limit maximum range size to prevent resource exhaustion

[Carlos O'Donell]

On 10/29/25 12:59 PM, Adhemerval Zanella Netto wrote:
> 
> 
> On 29/10/25 11:16, Anton Moryakov wrote:
>> The function `repertoire_new_char` uses values parsed from untrusted input
>> via `strtoul()` as loop bounds without enforcing a reasonable upper limit.
>> An attacker could craft a malformed repertoire map with an extremely large
>> range (e.g., SYMBOL1...SYMBOL999999999), causing excessive memory usage and
>> CPU consumption, leading to a denial-of-service condition.
>>
>> This patch introduces a new constant `MAX_RANGE_SIZE` (set to 1000) and
>> validates that the range size (to_nr - from_nr) does not exceed it before
>> entering the loop. This ensures predictable resource usage while still
>> supporting legitimate use cases.
>>
>> The fix enhances robustness against malicious input, aligning with security
>> best practices for parsing untrusted data in system libraries.
>>
>> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> 
> 
> Do we have a testcase that triggers this issue? And do we need a bug report
> for this?

If we're fixing a bug in a released version of glibc we should have a bug
report for this issue e.g. create a glibc bug, and document the issue
in the bug, then include the bug reference in the patch when fixing the
issue.

Anton,

Are you able to create a bug for this fix?

-- 
Cheers,
Carlos.