[PATCH 2.39] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

[Adarsh Jagadish Kamini]

Hi,
I've sent backported patch series for 2.40 with the CVE fix as well as prerequisites. I will also send for 2.39 now.

Thanks!
________________________________
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Sent: Thursday, July 23, 2026 14:04
To: Florian Weimer <fweimer@redhat.com>
Cc: libc-alpha@sourceware.org <libc-alpha@sourceware.org>; carlos@redhat.com <carlos@redhat.com>; adhemerval.zanella@linaro.org <adhemerval.zanella@linaro.org>
Subject: Re: [PATCH 2.39] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

Thanks for your review, Florian. I will send a fix for [BZ #12701] and BZ #34008 in a patch series as version 2. I will also send it for 2.40.
________________________________
From: Florian Weimer <fweimer@redhat.com>
Sent: Thursday, July 23, 2026 13:43
To: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Cc: libc-alpha@sourceware.org <libc-alpha@sourceware.org>; carlos@redhat.com <carlos@redhat.com>; adhemerval.zanella@linaro.org <adhemerval.zanella@linaro.org>
Subject: Re: [PATCH 2.39] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

* Adarsh Jagadish Kamini:

> From: Rocket Ma <marocketbd@gmail.com>
>
> * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
> format %mc or %mC, glibc allocates one byte less, leading to
> user-controlled one byte overflow. This commit fixes BZ #34008, or
> CVE-2026-5450.

We should fix 2.40 first, I think it's still missing the backport.
You'll also need to include the special fixes from the newer release
branches, around DJ's “stdio-common: Allow partially-filled %mc buffers
[BZ #12701]”.

Thanks,
Florian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260723/ac0d9b00/attachment-0001.htm>