public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
[parent not found: <bug-19351-192@http.gcc.gnu.org/bugzilla/>]
* [Bug c++/19351] New: operator new[] can return heap blocks which are too small
@ 2005-01-09 22:18 fw at deneb dot enyo dot de
  2005-01-09 22:25 ` [Bug c++/19351] " pinskia at gcc dot gnu dot org
                   ` (6 more replies)
  0 siblings, 7 replies; 33+ messages in thread
From: fw at deneb dot enyo dot de @ 2005-01-09 22:18 UTC (permalink / raw)
  To: gcc-bugs

operator new[] sometimes returns pointers to heap blocks which are too small. 
When a new array is allocated, the C++ run-time has to calculate its size.  The
product may exceed the maximum value which can be stored in a machine register.
 This error is ignored, and the truncated value is used for the heap allocation.

This may lead to heap overflows and therefore security bugs.  (See
http://cert.uni-stuttgart.de/advisories/calloc.php for further references.)

The test case below uses a user-defined operator new[] to test for the presence
of this problem.  However, the problem itself occurs also with the default
operator new[], but it is probably harder to write a portable test case.

#include <testsuite_hooks.h>

struct foo
{
  char data[16];
  void* operator new[] (size_t size)
  {
    VERIFY(size != sizeof(foo));
    VERIFY (false);
    return malloc(size);
  }
};

int
main()
{
  size_t size = size_t (-1) / sizeof(foo) + 2;
  try
    {
      foo* f = new foo[size];
      VERIFY (f == 0);
      VERIFY (false);
    }
  catch(std::bad_alloc&)
    {
      return 0;
    }
}

-- 
           Summary: operator new[] can return heap blocks which are too
                    small
           Product: gcc
           Version: 3.4.3
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: fw at deneb dot enyo dot de
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19351


^ permalink raw reply	[flat|nested] 33+ messages in thread
end of thread, other threads:[~2014-02-16 10:01 UTC | newest]

Thread overview: 33+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <bug-19351-4@http.gcc.gnu.org/bugzilla/>
2011-01-22 21:27 ` [Bug c++/19351] operator new[] can return heap blocks which are too small fw at gcc dot gnu.org
2011-05-24 13:00 ` redi at gcc dot gnu.org
2011-05-24 20:12 ` fw at gcc dot gnu.org
2012-02-07 21:34 ` [Bug c++/19351] [DR 624] " redi at gcc dot gnu.org
2012-07-17  9:08 ` fweimer at redhat dot com
2012-08-20 21:16 ` fw at gcc dot gnu.org
2012-08-20 21:26 ` fw at gcc dot gnu.org
2012-10-01  8:12 ` jakub at gcc dot gnu.org
2014-02-16 10:01 ` jackie.rosen at hushmail dot com
     [not found] <bug-19351-192@http.gcc.gnu.org/bugzilla/>
2006-09-27 23:51 ` [Bug c++/19351] " geoffk at gcc dot gnu dot org
2006-09-27 23:56   ` Andrew Pinski
2006-09-27 23:56 ` pinskia at physics dot uc dot edu
2007-03-23 15:00 ` mmitchel at gcc dot gnu dot org
2007-03-23 15:09 ` schwab at suse dot de
2007-03-23 15:23 ` fw at deneb dot enyo dot de
2008-04-01 20:46 ` pinskia at gcc dot gnu dot org
2008-04-01 20:48 ` pinskia at gcc dot gnu dot org
2008-04-01 21:25 ` felix-gcc at fefe dot de
2008-04-01 21:52 ` rguenth at gcc dot gnu dot org
2008-12-09 23:25 ` mrs at apple dot com
2010-02-06  8:20 ` fw at gcc dot gnu dot org
2010-03-22 18:40 ` tglek at mozilla dot com
2010-03-25 16:45 ` fw at gcc dot gnu dot org
2010-03-25 16:58 ` manu at gcc dot gnu dot org
2010-03-25 17:14 ` fw at gcc dot gnu dot org
2010-05-23 11:04 ` fw at gcc dot gnu dot org
2005-01-09 22:18 [Bug c++/19351] New: " fw at deneb dot enyo dot de
2005-01-09 22:25 ` [Bug c++/19351] " pinskia at gcc dot gnu dot org
2005-01-09 22:35 ` fw at deneb dot enyo dot de
2005-01-09 22:45 ` pinskia at gcc dot gnu dot org
2005-01-09 22:47 ` pinskia at gcc dot gnu dot org
2005-01-09 22:48 ` bangerth at dealii dot org
2005-01-09 23:07 ` fw at deneb dot enyo dot de
2005-01-09 23:12 ` pinskia at gcc dot gnu dot org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).