[Bug libc/6919] New: posix_spawnattr_getschedparam overwrites unrelated memory

[Bug libc/6919] New: posix_spawnattr_getschedparam overwrites unrelated memory

[bruno at clisp dot org]

The posix_spawnattr_getschedparam function overwrites memory beyond the given
output parameter.

The attached testcase prints
$ gcc -O -Wall bug.c -o bug
$ ./bug
value was 66 and is now 0
Aborted

-- 
           Summary: posix_spawnattr_getschedparam overwrites unrelated
                    memory
           Product: glibc
           Version: 2.8
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: bruno at clisp dot org
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: i586-suse-linux
  GCC host triplet: i586-suse-linux
GCC target triplet: i586-suse-linux


http://sourceware.org/bugzilla/show_bug.cgi?id=6919

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/6919] posix_spawnattr_getschedparam overwrites unrelated memory

[bruno at clisp dot org]

------- Additional Comments From bruno at clisp dot org  2008-09-27 18:33 -------
Created an attachment (id=2964)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=2964&action=view)
test case


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=6919

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/6919] posix_spawnattr_getschedparam overwrites unrelated memory

[bruno at clisp dot org]

------- Additional Comments From bruno at clisp dot org  2008-09-27 18:40 -------
Created an attachment (id=2965)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=2965&action=view)
a fix

Attached is a fix. Like in the file spawnattr_setschedparam.c, a simple
assignment is sufficient - no need for memcpy at all.

Btw, you can also remove the include <string.h> from spawnattr_setschedparam.c.


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=6919

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/6919] posix_spawnattr_getschedparam overwrites unrelated memory

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2008-10-31 18:51 -------
I fixed the code bug by leaving the memcpy.  The compiler is smart enough.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=6919

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/6919] posix_spawnattr_getschedparam overwrites unrelated memory

[bruno at clisp dot org]

------- Additional Comments From bruno at clisp dot org  2008-11-02 00:55 -------
> I fixed the code bug by leaving the memcpy.  The compiler is smart enough.

The point about using an assignment rather than memcpy is that the compiler
would have reported this bug as an error already.
When you use an assignment, the compiler verifies that the source type and the
target type are the same. When you use memcpy, it doesn't.

Even excellent programmers occasionally make mistakes, like in this case. The
compiler can prevent you from making this kind of mistake.


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=6919

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/6919] posix_spawnattr_getschedparam overwrites unrelated memory

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=6919

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security-

--- Comment #5 from Florian Weimer <fweimer at redhat dot com> ---
I'm flagging this security- despite the out-of-bounds write.  The function is
rarely used.

-- 
You are receiving this mail because:
You are on the CC list for the bug.