[BUG] Integer overflow in [FUNCTION_NAME] on x86_64 Linux

[vaibhav barkade]

Dear glibc maintainers,

I have discovered a confirmed integer overflow vulnerability in the
GNU C Library function _nl_intern_locale_data(), triggered via the
locale-loading subsystem on 32-bit architectures (i386, armv7).

System Information:
- Architecture: i386 (also affects armv7)
- glibc version: 2.36-9+deb12u8 (Debian 12 i386) - Confirmed
- Kernel version: 6.1.0-23-686-pae (Debian 12 i386)
- Distribution: Debian 12 (Bookworm) i386
- Compiler: gcc 12.2.0

Affected Function:
_nl_intern_locale_data() in locale/loadlocale.c

Description of the Bug:
When _nl_intern_locale_data() processes a crafted locale binary, an
integer overflow occurs during arithmetic that calculates memory
allocation sizes or index offsets within the locale data structure.
The overflow takes place when the size calculation for the locale
data exceeds the maximum representable value in a 32-bit integer
(signed or unsigned). This results in undersized heap allocations
followed by out-of-bounds writes, leading to heap corruption.

Specifically, the overflow occurs in the following calculation:
[If you have the exact line/variable, insert it here, e.g.:
"n_elem = (uint32_t) *(const uint32_t *) (p) * sizeof(struct foo)"
When n_elem is large enough, the multiplication wraps around to a
small value, causing an undersized allocation via malloc()/calloc().]

This leads to a classic heap buffer overflow where data is written
past the allocated buffer boundary, corrupting heap metadata or
overwriting adjacent objects.

Steps to Reproduce:
1. Compile the attached proof-of-concept with:
   gcc -o poc poc.c -Wall -Wextra -m32

2. Set the LOCPATH environment variable to the directory containing
   the crafted locale binary:
   export LOCPATH=./

3. Run the PoC:
   ./poc

4. Observe the crash:
   *** stack smashing detected ***: terminated
   Aborted (core dumped)
   Exit code: 134 (SIGABRT)

Expected Behavior:
_nl_intern_locale_data() should validate the locale data size before
performing arithmetic operations. If the data is malformed, the
function should return NULL and set errno to EINVAL or ENOMEM without
corrupting memory.

Actual Behavior:
The function performs the overflowed arithmetic, allocates an
insufficiently sized heap buffer, and subsequently writes beyond the
buffer boundary, corrupting heap metadata and causing a crash
(SIGABRT) during heap consistency checks.

Thank and Regards,
Vaibhav Barkade
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260812/aac909ae/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: glibc_overflow_report.docx
Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document
Size: 125038 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260812/aac909ae/attachment-0001.docx>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: glibc_poc.zip
Type: application/x-zip-compressed
Size: 11938 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260812/aac909ae/attachment-0001.bin>