public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug network/15698] New: Memory overrun in getifaddrs_internal
@ 2013-06-27 21:04 hjl.tools at gmail dot com
  2013-10-24  8:05 ` [Bug network/15698] " cvs-commit at gcc dot gnu.org
                   ` (4 more replies)
  0 siblings, 5 replies; 6+ messages in thread
From: hjl.tools at gmail dot com @ 2013-06-27 21:04 UTC (permalink / raw)
  To: glibc-bugs

http://sourceware.org/bugzilla/show_bug.cgi?id=15698

            Bug ID: 15698
           Summary: Memory overrun in getifaddrs_internal
           Product: glibc
           Version: 2.18
            Status: NEW
          Severity: normal
          Priority: P2
         Component: network
          Assignee: unassigned at sourceware dot org
          Reporter: hjl.tools at gmail dot com

When the netmask length is the same as address size, getifaddrs_internal
has memory overrun in

                 if (cp != NULL)
                    {
                      char c;
                      unsigned int preflen;

                      if ((max_prefixlen > 0) &&
                          (ifam->ifa_prefixlen > max_prefixlen))
                        preflen = max_prefixlen;
                      else
                        preflen = ifam->ifa_prefixlen;

                      for (i = 0; i < (preflen / 8); i++)
                        *cp++ = 0xff;
                      c = 0xff;
                      c <<= (8 - (preflen % 8));
                      *cp = c;
                    }

It should check if preflen < max_prefixlen before updating
the last byte of netmask.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-09-10 20:23 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-06-27 21:04 [Bug network/15698] New: Memory overrun in getifaddrs_internal hjl.tools at gmail dot com
2013-10-24  8:05 ` [Bug network/15698] " cvs-commit at gcc dot gnu.org
2014-06-05 17:27 ` cvs-commit at gcc dot gnu.org
2014-06-13 13:30 ` fweimer at redhat dot com
2014-09-10 20:23 ` simongmzlj at gmail dot com
2014-09-10 20:23 ` simongmzlj at gmail dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).