[Bug libc/7066] New: Probable buffer overrun in strtold()

["nix at esperi dot org dot uk" <sourceware-bugzilla@sourceware.org>]

When testing with the stack-protector patch in #7065, test-strtod is killed by 
the stack-protector:

strtod ("12.345") test 0        OK
strtod ("12.345e19") test 1     OK
strtod ("-.1e+9") test 2        OK
strtod (".125") test 3  OK
strtod ("1e20") test 4  OK
strtod ("0e-19") test 5 OK
strtod ("4") test 6     OK
strtod ("5.9e-76") test 7       OK
strtod ("0x1.4p+3") test 8      OK
strtod ("0xAp0") test 9 OK
strtod ("0x0Ap0") test 10       OK
strtod ("0x0A") test 11 OK
strtod ("0xA0") test 12 OK
strtod ("0x0.A0p8") test 13     OK
strtod ("0x0.50p9") test 14     OK
strtod ("0x0.28p10") test 15    OK
strtod ("0x0.14p11") test 16    OK
strtod ("0x0.0A0p12") test 17   OK
strtod ("0x0.050p13") test 18   OK
strtod ("0x0.028p14") test 19   OK
strtod ("0x0.014p15") test 20   OK
strtod ("0x00.00A0p16") test 21 OK
strtod ("0x00.0050p17") test 22 OK
strtod ("0x00.0028p18") test 23 OK
strtod ("0x00.0014p19") test 24 OK
strtod ("0x1p-1023") test 25    OK
strtod ("0x0.8p-1022") test 26  OK
strtod ("Inf") test 27  OK
strtod ("-Inf") test 28 OK
strtod ("+InFiNiTy") test 29    OK
strtod ("0x80000Ap-23") test 30 OK
*** stack smashing detected ***: tst-strtod - terminated
tst-strtod: stack smashing attack in function <unknown> - terminated
tst-strtod: stack smashing attack in function <unknown> - terminated

The backtrace (when linked against -lc_g) is as follows:

#0  0xb80f2424 in __kernel_vsyscall ()
#1  0x0806bc2b in __stack_chk_fail () at stack_chk_fail.c:295
#2  0x08057426 in ____strtold_l_internal (nptr=0x80ae069 "42.", '0' <repeats 19 
times>, "1", endptr=0x0, group=0, loc=0x80cc020) at ../stdlib/strtod_l.c:1571
#3  0x080509a7 in strtold (nptr=0x80ae069 "42.", '0' <repeats 19 times>, "1", 
endptr=0x0) at strtod.c:70
#4  0x0804863e in main (argc=1, argv=0xbf9f1af4) at tst-strtod.c:168

I'll attach a one-liner to reproduce it as soon as I strip the test down (I 
used to have one, but that was six months ago).

-- 
           Summary: Probable buffer overrun in strtold()
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: nix at esperi dot org dot uk
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: i686-pc-linux-gnu
  GCC host triplet: i686-pc-linux-gnu
GCC target triplet: i686-pc-linux-gnu


http://sourceware.org/bugzilla/show_bug.cgi?id=7066

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.