From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <glibc-bugs-regex-return-511-listarch-glibc-bugs-regex=sources.redhat.com@sourceware.org>
Received: (qmail 3021 invoked by alias); 16 Jun 2011 03:07:20 -0000
Received: (qmail 3007 invoked by uid 22791); 16 Jun 2011 03:07:19 -0000
X-SWARE-Spam-Status: No, hits=-2.8 required=5.0	tests=ALL_TRUSTED,AWL,BAYES_00
X-Spam-Check-By: sourceware.org
Received: from localhost (HELO sourceware.org) (127.0.0.1)    by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 16 Jun 2011 03:07:07 +0000
From: "yangdingning at gmail dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs-regex@sources.redhat.com
Subject: [Bug regex/12896] New: regexec() stack overflow denial of service
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: glibc
X-Bugzilla-Component: regex
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: yangdingning at gmail dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: drepper.fsp at gmail dot com
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Changed-Fields:
Message-ID: <bug-12896-132@http.sourceware.org/bugzilla/>
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
Content-Type: text/plain; charset="UTF-8"
MIME-Version: 1.0
Date: Thu, 16 Jun 2011 03:07:00 -0000
Mailing-List: contact glibc-bugs-regex-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <glibc-bugs-regex.sourceware.org>
List-Subscribe: <mailto:glibc-bugs-regex-subscribe@sourceware.org>
List-Post: <mailto:glibc-bugs-regex@sourceware.org>
List-Help: <mailto:glibc-bugs-regex-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: glibc-bugs-regex-owner@sourceware.org
X-SW-Source: 2011-06/txt/msg00000.txt.bz2

http://sourceware.org/bugzilla/show_bug.cgi?id=12896

           Summary: regexec() stack overflow denial of service
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: regex
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: yangdingning@gmail.com


An easy way to reproduce is:

$ echo | grep -E "(.*)\1{4}+"
Segmentation fault (core dumped)
$

This bug has been verified to exist in glibc 2.11.1 shipped with Ubuntu 10.04,
as well as the latest version from git repository. It may have security
implications as shown in the description of CVE-2010-4051 and CVE-2010-4052.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.