public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/13506] New: tzfile.c heap overrun/corruption
@ 2011-12-15 20:45 eggert at gnu dot org
  2011-12-15 21:01 ` [Bug libc/13506] " eggert at gnu dot org
                   ` (11 more replies)
  0 siblings, 12 replies; 13+ messages in thread
From: eggert at gnu dot org @ 2011-12-15 20:45 UTC (permalink / raw)
  To: glibc-bugs

http://sourceware.org/bugzilla/show_bug.cgi?id=13506

             Bug #: 13506
           Summary: tzfile.c heap overrun/corruption
           Product: glibc
           Version: 2.14
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: eggert@gnu.org
    Classification: Unclassified


Created attachment 6113
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6113
Jeff Law work-in-progress patch

In <http://cygwin.com/ml/libc-alpha/2011-12/msg00037.html>
Jeff Law writes:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

As y'all may be aware, there's an integer overflow which can be used
to trigger a heap overrun/corruption in time/tzfile.c

http://dividead.wordpress.com/2009/06/01/glibc-timezone-integer-overflow/


http://rcvalle.com/post/14169476482/exploiting-glibc-tzfile-read-integer-overflow-to


I'm not terribly familiar with the code in question, but ISTM we have
to verify the intermediate computations to determine the amount of
memory to malloc don't overflow/wrap.

Here's a WIP.  It catches the cases I've been made aware of
(overflowing total_size to 0 by creating a tzfile with a very large
tzh_charcnt).  But there may be further overflows I've missed.

Obviously it's not commented and it's unclear to me if we also want to
put in some kind of sanity checks on total_size to prevent it from
trying to malloc unreasoanble amounts of memory.

Your feedback would be greatly appreciated.




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJO6k6gAAoJEBRtltQi2kC7ASQH/0UmQm0wqk3NRmlsVr5M1r3f
fUelY55y8OQssaFCLDZ9LX1vybam9j85gmvGtRJUU4MJ3134hn/v73k8TYCd3rHJ
/QIQY10zPBHkmEwp8G56+3l9QRl418C+ajTq0W4NAzM1rIHtPUgrqZ3AkNJgFVYU
OAF+2afFDGE5vJ3HR7LSL62tuxjDf7m66r4tHHkbhkSSZgkyW/YxfFUPDupZnlz8
Wl87JU/RWHdMJ+RR+fB1ofgFKrNZnGpIsD3sAc07KWTp63S358DSRpZ1IaF2o3vh
N93z28eCQQKIVciOKgAE5q/qYr1KmcyU/6M4xPk+Pqv5YFdKOz8uNiw5NQu2rv0=
=RKgA
-----END PGP SIGNATURE-----

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2014-06-27 11:30 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-12-15 20:45 [Bug libc/13506] New: tzfile.c heap overrun/corruption eggert at gnu dot org
2011-12-15 21:01 ` [Bug libc/13506] " eggert at gnu dot org
2011-12-15 21:45 ` law at redhat dot com
2011-12-15 23:06 ` vapier at gentoo dot org
2011-12-16  8:38 ` rguenth at gcc dot gnu.org
2011-12-16 10:48 ` allan at archlinux dot org
2011-12-16 10:54 ` mpolacek at redhat dot com
2011-12-18  1:19 ` drepper.fsp at gmail dot com
2011-12-19  5:36 ` vapier at gentoo dot org
2011-12-19  5:52 ` allan at archlinux dot org
2011-12-19  7:59 ` law at redhat dot com
2011-12-21 23:58 ` drepper.fsp at gmail dot com
2014-06-27 11:30 ` [Bug libc/13506] tzfile.c heap overrun/corruption (CVE-2009-5029) fweimer at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).