[Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers

[Bug libc/13446] New: crash in vfprintf with more than 64 format args and format specifiers

[rcoe at wi dot rr.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

             Bug #: 13446
           Summary: crash in vfprintf with more than 64 format args and
                    format specifiers
           Product: glibc
           Version: 2.14
               URL: https://bugzilla.novell.com/show_bug.cgi?id=733140
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: rcoe@wi.rr.com
    Classification: Unclassified


Created attachment 6077
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6077
testcase

A user found this in an application that uses format specifiers and
motif was initializing.

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff7a91ec8 in _IO_vfprintf_internal (s=<optimized out>,
format=<optimized out>, ap=<optimized out>)
    at vfprintf.c:1739
#2  0x00007ffff7ab5024 in __IO_vsprintf (string=0x603020 "", 
    format=0x601080
"%%P%%S:%s/%%L/%%T/%%N/%%P%%S:%s/%%l_%%t/%%T/%%N/%%P%%S:%s/%%l/%%T/%%N/%%P%%S:%s/%%T/%%N/%%P%%S:%s/%%L/%%T/%%P%%S:%s/%%l_%%t/%%T/%%P%%S:%s/%%l/%%T/%%P%%S:%s/%%T/%%P%%S:%s/%%P%%S:%s/%%L/%%T/%%N/%%P%%S:%"...,
args=0x7fffffffc6c8) at iovsprintf.c:43
#3  0x00007ffff7a9c0a7 in __sprintf (s=<optimized out>, format=<optimized out>)
at sprintf.c:34
#4  0x00000000004009d3 in main (argc=1, argv=0x7fffffffd928) at mtest.c:98

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[rcoe at wi dot rr.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

--- Comment #1 from Rich Coe <rcoe at wi dot rr.com> 2011-11-29 03:39:22 UTC ---
Created attachment 6078
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6078
patch

# patch to fix printf when register_printf_function is in use and the format to
# printf contains more than 64 elements.
#
# extend_alloca modifies nspecs_max (2nd arg) with the size of the space, not
the 
# number of elements.  Use a temporary to store the return value.  Explicitly
set the correct size.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[aj at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

Andreas Jaeger <aj at suse dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aj at suse dot de

--- Comment #2 from Andreas Jaeger <aj at suse dot de> 2011-11-29 08:55:50 UTC ---
Thanks, this patch fixes indeed the testcase.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[aj at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

--- Comment #3 from Andreas Jaeger <aj at suse dot de> 2011-11-29 10:38:41 UTC ---
The following comment was made to the downstream bugreport
https://bugzilla.novell.com/show_bug.cgi?id=733140#c6 by Christoph Bartoschek:

I would suggest the following patch instead. This way nsize is initialized with
the correct number of bytes. And nspecs_max uses the whole given buffer.

diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index 753a5ac..6e026ae 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1683,8 +1683,9 @@ do_positional:
          {
            /* Extend the array of format specifiers.  */
            struct printf_spec *old = specs;
-           specs = extend_alloca (specs, nspecs_max,
-                                  2 * nspecs_max * sizeof (*specs));
+           size_t nsize = nspecs_max * sizeof(*specs);
+           specs = extend_alloca (specs, nsize, 2 * nsize);
+           nspecs_max = nsize/sizeof(*specs);

            /* Copy the old array's elements to the new space.  */
            memmove (specs, old, nspecs * sizeof (struct printf_spec));

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[rcoe at wi dot rr.com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

--- Comment #4 from Rich Coe <rcoe at wi dot rr.com> 2011-11-29 12:22:40 UTC ---
nsize does not always represent the correct size of the returned object,
due to the way that extend_alloca (an internal glibc macro) is implemented.

I wouldn't recommend this latest proposal.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[gnu at pontohonk dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

Christoph Bartoschek <gnu at pontohonk dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |gnu at pontohonk dot de

--- Comment #5 from Christoph Bartoschek <gnu at pontohonk dot de> 2011-12-05 12:43:54 UTC ---
I suggest that the patch from #3 is used.

- extend_alloca sets the second parameter to a value that can safely be used.
There is no possibility that nsize is larger than the usable buffer size after
extend_alloca.

- If one does not want to use the extending feature of extend_alloca then one
should just use alloca.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from Ulrich Drepper <drepper.fsp at gmail dot com> 2011-12-18 02:29:12 UTC ---
I checked in a correct patch.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[aj at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

Andreas Jaeger <aj at suse dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |

--- Comment #7 from Andreas Jaeger <aj at suse dot de> 2011-12-18 06:32:26 UTC ---
The patch is wrong, you need to increase nspecs_size in the for loop if you do
a new alloca call.

Otherwise you call alloca every time with nspecs_size*2  - and eventually
override the array

Add after:
 specs = extend_alloca (specs, nspecs_size, 2 * nspecs_size);

a line with:
 nspecs_size = 2 * nspecs_size;

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[schwab@linux-m68k.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=13446

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #8 from Andreas Schwab <schwab@linux-m68k.org> 2011-12-18 09:10:10 UTC ---
That's what extend_alloca does.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[jackie.rosen at hushmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13446

Jackie Rosen <jackie.rosen at hushmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jackie.rosen at hushmail dot com

--- Comment #9 from Jackie Rosen <jackie.rosen at hushmail dot com> ---
*** Bug 260998 has been marked as a duplicate of this bug. ***
Seen from the domain http://volichat.com
Page where seen: http://volichat.com/adult-chat-rooms
Marked for reference. Resolved as fixed @bugzilla.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[schwab at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=13446

Andreas Schwab <schwab at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|jackie.rosen at hushmail dot com   |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[vapier at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=13446

Mike Frysinger <vapier at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |vapier at gentoo dot org
              Alias|                            |CVE-2012-3405

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers

[vapier at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=13446

--- Comment #10 from Mike Frysinger <vapier at gentoo dot org> ---
for reference, the change:
https://sourceware.org/git/?p=glibc.git;a=commit;h=a4647e727a2a52e1259474c13f4b13288938bed4

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/13446] crash in vfprintf with more than 64 format args and format specifiers (CVE-2012-3405)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=13446

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
            Summary|crash in vfprintf with more |crash in vfprintf with more
                   |than 64 format args and     |than 64 format args and
                   |format specifiers           |format specifiers
                   |                            |(CVE-2012-3405)
              Flags|                            |security+

-- 
You are receiving this mail because:
You are on the CC list for the bug.