* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
@ 2011-11-29 3:39 ` rcoe at wi dot rr.com
2011-11-29 8:56 ` aj at suse dot de
` (11 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: rcoe at wi dot rr.com @ 2011-11-29 3:39 UTC (permalink / raw)
To: glibc-bugs
http://sourceware.org/bugzilla/show_bug.cgi?id=13446
--- Comment #1 from Rich Coe <rcoe at wi dot rr.com> 2011-11-29 03:39:22 UTC ---
Created attachment 6078
--> http://sourceware.org/bugzilla/attachment.cgi?id=6078
patch
# patch to fix printf when register_printf_function is in use and the format to
# printf contains more than 64 elements.
#
# extend_alloca modifies nspecs_max (2nd arg) with the size of the space, not
the
# number of elements. Use a temporary to store the return value. Explicitly
set the correct size.
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
2011-11-29 3:39 ` [Bug libc/13446] " rcoe at wi dot rr.com
@ 2011-11-29 8:56 ` aj at suse dot de
2011-11-29 10:39 ` aj at suse dot de
` (10 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: aj at suse dot de @ 2011-11-29 8:56 UTC (permalink / raw)
To: glibc-bugs
http://sourceware.org/bugzilla/show_bug.cgi?id=13446
Andreas Jaeger <aj at suse dot de> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |aj at suse dot de
--- Comment #2 from Andreas Jaeger <aj at suse dot de> 2011-11-29 08:55:50 UTC ---
Thanks, this patch fixes indeed the testcase.
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
2011-11-29 3:39 ` [Bug libc/13446] " rcoe at wi dot rr.com
2011-11-29 8:56 ` aj at suse dot de
@ 2011-11-29 10:39 ` aj at suse dot de
2011-11-29 12:23 ` rcoe at wi dot rr.com
` (9 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: aj at suse dot de @ 2011-11-29 10:39 UTC (permalink / raw)
To: glibc-bugs
http://sourceware.org/bugzilla/show_bug.cgi?id=13446
--- Comment #3 from Andreas Jaeger <aj at suse dot de> 2011-11-29 10:38:41 UTC ---
The following comment was made to the downstream bugreport
https://bugzilla.novell.com/show_bug.cgi?id=733140#c6 by Christoph Bartoschek:
I would suggest the following patch instead. This way nsize is initialized with
the correct number of bytes. And nspecs_max uses the whole given buffer.
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index 753a5ac..6e026ae 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1683,8 +1683,9 @@ do_positional:
{
/* Extend the array of format specifiers. */
struct printf_spec *old = specs;
- specs = extend_alloca (specs, nspecs_max,
- 2 * nspecs_max * sizeof (*specs));
+ size_t nsize = nspecs_max * sizeof(*specs);
+ specs = extend_alloca (specs, nsize, 2 * nsize);
+ nspecs_max = nsize/sizeof(*specs);
/* Copy the old array's elements to the new space. */
memmove (specs, old, nspecs * sizeof (struct printf_spec));
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (2 preceding siblings ...)
2011-11-29 10:39 ` aj at suse dot de
@ 2011-11-29 12:23 ` rcoe at wi dot rr.com
2011-12-05 12:44 ` gnu at pontohonk dot de
` (8 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: rcoe at wi dot rr.com @ 2011-11-29 12:23 UTC (permalink / raw)
To: glibc-bugs
http://sourceware.org/bugzilla/show_bug.cgi?id=13446
--- Comment #4 from Rich Coe <rcoe at wi dot rr.com> 2011-11-29 12:22:40 UTC ---
nsize does not always represent the correct size of the returned object,
due to the way that extend_alloca (an internal glibc macro) is implemented.
I wouldn't recommend this latest proposal.
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (3 preceding siblings ...)
2011-11-29 12:23 ` rcoe at wi dot rr.com
@ 2011-12-05 12:44 ` gnu at pontohonk dot de
2011-12-18 2:29 ` drepper.fsp at gmail dot com
` (7 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: gnu at pontohonk dot de @ 2011-12-05 12:44 UTC (permalink / raw)
To: glibc-bugs
http://sourceware.org/bugzilla/show_bug.cgi?id=13446
Christoph Bartoschek <gnu at pontohonk dot de> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |gnu at pontohonk dot de
--- Comment #5 from Christoph Bartoschek <gnu at pontohonk dot de> 2011-12-05 12:43:54 UTC ---
I suggest that the patch from #3 is used.
- extend_alloca sets the second parameter to a value that can safely be used.
There is no possibility that nsize is larger than the usable buffer size after
extend_alloca.
- If one does not want to use the extending feature of extend_alloca then one
should just use alloca.
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (4 preceding siblings ...)
2011-12-05 12:44 ` gnu at pontohonk dot de
@ 2011-12-18 2:29 ` drepper.fsp at gmail dot com
2011-12-18 6:33 ` aj at suse dot de
` (6 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: drepper.fsp at gmail dot com @ 2011-12-18 2:29 UTC (permalink / raw)
To: glibc-bugs
http://sourceware.org/bugzilla/show_bug.cgi?id=13446
Ulrich Drepper <drepper.fsp at gmail dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
--- Comment #6 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-12-18 02:29:12 UTC ---
I checked in a correct patch.
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (5 preceding siblings ...)
2011-12-18 2:29 ` drepper.fsp at gmail dot com
@ 2011-12-18 6:33 ` aj at suse dot de
2011-12-18 9:11 ` schwab@linux-m68k.org
` (5 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: aj at suse dot de @ 2011-12-18 6:33 UTC (permalink / raw)
To: glibc-bugs
http://sourceware.org/bugzilla/show_bug.cgi?id=13446
Andreas Jaeger <aj at suse dot de> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |
--- Comment #7 from Andreas Jaeger <aj at suse dot de> 2011-12-18 06:32:26 UTC ---
The patch is wrong, you need to increase nspecs_size in the for loop if you do
a new alloca call.
Otherwise you call alloca every time with nspecs_size*2 - and eventually
override the array
Add after:
specs = extend_alloca (specs, nspecs_size, 2 * nspecs_size);
a line with:
nspecs_size = 2 * nspecs_size;
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (6 preceding siblings ...)
2011-12-18 6:33 ` aj at suse dot de
@ 2011-12-18 9:11 ` schwab@linux-m68k.org
2014-02-16 19:42 ` jackie.rosen at hushmail dot com
` (4 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: schwab@linux-m68k.org @ 2011-12-18 9:11 UTC (permalink / raw)
To: glibc-bugs
http://sourceware.org/bugzilla/show_bug.cgi?id=13446
Andreas Schwab <schwab@linux-m68k.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #8 from Andreas Schwab <schwab@linux-m68k.org> 2011-12-18 09:10:10 UTC ---
That's what extend_alloca does.
--
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (7 preceding siblings ...)
2011-12-18 9:11 ` schwab@linux-m68k.org
@ 2014-02-16 19:42 ` jackie.rosen at hushmail dot com
2014-05-28 19:40 ` schwab at sourceware dot org
` (3 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: jackie.rosen at hushmail dot com @ 2014-02-16 19:42 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=13446
Jackie Rosen <jackie.rosen at hushmail dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jackie.rosen at hushmail dot com
--- Comment #9 from Jackie Rosen <jackie.rosen at hushmail dot com> ---
*** Bug 260998 has been marked as a duplicate of this bug. ***
Seen from the domain http://volichat.com
Page where seen: http://volichat.com/adult-chat-rooms
Marked for reference. Resolved as fixed @bugzilla.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (8 preceding siblings ...)
2014-02-16 19:42 ` jackie.rosen at hushmail dot com
@ 2014-05-28 19:40 ` schwab at sourceware dot org
2014-06-14 22:31 ` vapier at gentoo dot org
` (2 subsequent siblings)
12 siblings, 0 replies; 14+ messages in thread
From: schwab at sourceware dot org @ 2014-05-28 19:40 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=13446
Andreas Schwab <schwab at sourceware dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC|jackie.rosen at hushmail dot com |
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (9 preceding siblings ...)
2014-05-28 19:40 ` schwab at sourceware dot org
@ 2014-06-14 22:31 ` vapier at gentoo dot org
2014-06-14 22:35 ` vapier at gentoo dot org
2014-06-16 12:20 ` [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers (CVE-2012-3405) fweimer at redhat dot com
12 siblings, 0 replies; 14+ messages in thread
From: vapier at gentoo dot org @ 2014-06-14 22:31 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=13446
Mike Frysinger <vapier at gentoo dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |vapier at gentoo dot org
Alias| |CVE-2012-3405
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (10 preceding siblings ...)
2014-06-14 22:31 ` vapier at gentoo dot org
@ 2014-06-14 22:35 ` vapier at gentoo dot org
2014-06-16 12:20 ` [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers (CVE-2012-3405) fweimer at redhat dot com
12 siblings, 0 replies; 14+ messages in thread
From: vapier at gentoo dot org @ 2014-06-14 22:35 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=13446
--- Comment #10 from Mike Frysinger <vapier at gentoo dot org> ---
for reference, the change:
https://sourceware.org/git/?p=glibc.git;a=commit;h=a4647e727a2a52e1259474c13f4b13288938bed4
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread
* [Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers (CVE-2012-3405)
2011-11-29 3:37 [Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers rcoe at wi dot rr.com
` (11 preceding siblings ...)
2014-06-14 22:35 ` vapier at gentoo dot org
@ 2014-06-16 12:20 ` fweimer at redhat dot com
12 siblings, 0 replies; 14+ messages in thread
From: fweimer at redhat dot com @ 2014-06-16 12:20 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=13446
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |fweimer at redhat dot com
Summary|crash in vfprintf with more |crash in vfprintf with more
|than 64 format args and |than 64 format args and
|format specifiers |format specifiers
| |(CVE-2012-3405)
Flags| |security+
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 14+ messages in thread