[Bug libc/13303] New: strange crash in 64bit vsnprintf()

[Bug libc/13303] New: strange crash in 64bit vsnprintf()

[ninive at gmx dot at]

http://sourceware.org/bugzilla/show_bug.cgi?id=13303

             Bug #: 13303
           Summary: strange crash in 64bit vsnprintf()
           Product: glibc
           Version: 2.11
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: ninive@gmx.at
    Classification: Unclassified


Created attachment 5989
  --> http://sourceware.org/bugzilla/attachment.cgi?id=5989
Testcase

vsnprintf() crashed on 64bit CentOS, but not on 32bit.

Backtrace (taken from CentOS 5):
#0 0x00000032a7479b60 in strlen () from /lib64/libc.so.6
0000001 0x00000032a7446cb9 in vfprintf () from /lib64/libc.so.6
0000002 0x00000032a74699da in vsnprintf () from /lib64/libc.so.6
#3 0x00000000006023cb in format (this=0x7fff315e9400, params=0xa22238 
#4 0x00000000009b3f86 in main (argc=1, argv=0x7fff315e9768)

Tested with
GNU libc: 2.5 (CentOS 5), 2.6.18-274.3.1.el5 x86_64 GNU/Linux
GNU libc: 2.11 (Ubuntu 10.04), 2.6.32-34-server x86_64 GNU/Linux

Steps to reproduce:
wget http://doppelbauer.name/vsnprintf.cpp
g++ -g -o vsnprintf vsnprintf.cpp
./vsnprintf

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13303] strange crash in 64bit vsnprintf()

[ninive at gmx dot at]

http://sourceware.org/bugzilla/show_bug.cgi?id=13303

Markus Doppelbauer <ninive at gmx dot at> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ninive at gmx dot at

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13303] strange crash in 64bit vsnprintf()

[aj at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=13303

Andreas Jaeger <aj at suse dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |aj at suse dot de
         Resolution|                            |INVALID

--- Comment #1 from Andreas Jaeger <aj at suse dot de> 2011-10-17 07:44:33 UTC ---
Your code is buggy, vsnprintf uses the args and you need to reset it.

    va_list args;
    va_start( args, params );

    char buffer[0x4000];
    unsigned int required = vsnprintf( buffer, sizeof(buffer), params, args );
Add va_end (args);va_start(args,params); here

    char *bigbuffer = (char*)malloc( required + 1 );
    vsnprintf( bigbuffer, required + 1, params, args );

    va_end( args );

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13303] strange crash in 64bit vsnprintf()

[ninive at gmx dot at]

http://sourceware.org/bugzilla/show_bug.cgi?id=13303

--- Comment #2 from Markus Doppelbauer <ninive at gmx dot at> 2011-10-17 08:12:56 UTC ---
Hi Andreas,

Thanks a lot. You are right.
Sorry for disturbing.

Markus

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13303] strange crash in 64bit vsnprintf()

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13303

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.