public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/5346] New: gettext crashes when a very long string is passed as argument and the stack size is limited
@ 2007-11-16  1:22 bruno at clisp dot org
  2007-11-16  1:24 ` [Bug libc/5346] " bruno at clisp dot org
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: bruno at clisp dot org @ 2007-11-16  1:22 UTC (permalink / raw)
  To: glibc-bugs

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1838 bytes --]

On most systems, the stack size is limited ("ulimit -s 8192" is often the
default).

In these conditions, gettext() crashes when the argument string is longer than
the maximum stack size.

This was reported in
<http://www.securityfocus.com/archive/1/483648/30/30/threaded>
and then reported to bug-gnu-gettext by Ismail Dönmez. Find attached a test case.
================================ foo.c ========================
#include <stdlib.h>
#include <string.h>

#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>

#include <libintl.h>

int
main ()
{
  size_t n;
  struct rlimit limit;
  char *msg;

  n = 1000000;

#ifdef RLIMIT_STACK
  if (getrlimit (RLIMIT_STACK, &limit) >= 0)
    {
      if (limit.rlim_max == RLIM_INFINITY || limit.rlim_max > n)
        limit.rlim_max = n;
      limit.rlim_cur = limit.rlim_max;
      setrlimit (RLIMIT_STACK, &limit);
    }
#endif

  msg = (char *) malloc (n + 1);
  memset (msg, 'x', n);
  msg[n] = '\0';

  msg = gettext (msg);

  return 0;
}
===============================================================
$ gcc -Wall foo.c
$ ./a.out 
Segmentation fault

-- 
           Summary: gettext crashes when a very long string is passed as
                    argument and the stack size is limited
           Product: glibc
           Version: 2.4
            Status: NEW
          Severity: minor
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: bruno at clisp dot org
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: i586-suse-linux
  GCC host triplet: i586-suse-linux
GCC target triplet: i586-suse-linux


http://sourceware.org/bugzilla/show_bug.cgi?id=5346

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2007-11-17  7:38 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-11-16  1:22 [Bug libc/5346] New: gettext crashes when a very long string is passed as argument and the stack size is limited bruno at clisp dot org
2007-11-16  1:24 ` [Bug libc/5346] " bruno at clisp dot org
2007-11-16  1:36 ` bruno at clisp dot org
2007-11-16  3:05 ` ismail at pardus dot org dot tr
2007-11-16  3:10 ` bruno at clisp dot org
2007-11-17  7:38 ` drepper at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).