public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/14459] New: strtod integer and buffer overflows
@ 2012-08-12 18:23 jsm28 at gcc dot gnu.org
  2012-08-13 17:35 ` [Bug libc/14459] " vapier at gentoo dot org
                   ` (6 more replies)
  0 siblings, 7 replies; 8+ messages in thread
From: jsm28 at gcc dot gnu.org @ 2012-08-12 18:23 UTC (permalink / raw)
  To: glibc-bugs

http://sourceware.org/bugzilla/show_bug.cgi?id=14459

             Bug #: 14459
           Summary: strtod integer and buffer overflows
           Product: glibc
           Version: 2.16
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: unassigned@sourceware.org
        ReportedBy: jsm28@gcc.gnu.org
                CC: drepper.fsp@gmail.com
    Classification: Unclassified


strtod and related functions have integer overflow bugs resulting from the use
of "int" for internal variables and calculations where the actual values
involved may exceed the range of int.  These integer overflows can in turn
result in buffer overflow on the stack.  The following testcase illustrates
such a buffer overflow.  Testing a patch.  (I found this issue while working on
the fix for bug 3479.)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define EXPONENT "e-2147483649"
#define SIZE 214748364

int
main (void)
{
  char *p = malloc (1 + SIZE + sizeof (EXPONENT));
  if (p == NULL)
    {
      perror ("malloc");
      exit (EXIT_FAILURE);
    }
  p[0] = '1';
  memset (p + 1, '0', SIZE);
  memcpy (p + 1 + SIZE, EXPONENT, sizeof (EXPONENT));
  double d = strtod (p, NULL);
  printf ("%a\n", d);
  exit (EXIT_SUCCESS);
}

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2014-06-17 18:45 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-08-12 18:23 [Bug libc/14459] New: strtod integer and buffer overflows jsm28 at gcc dot gnu.org
2012-08-13 17:35 ` [Bug libc/14459] " vapier at gentoo dot org
2012-08-13 19:12 ` bugdal at aerifal dot cx
2012-08-13 19:23 ` ppluzhnikov at google dot com
2012-08-15 22:08 ` allan at archlinux dot org
2012-08-27 16:12 ` jsm28 at gcc dot gnu.org
2012-08-27 23:03 ` jsm28 at gcc dot gnu.org
2014-06-17 18:45 ` [Bug libc/14459] strtod integer and buffer overflows (CVE-2012-3480) fweimer at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).