public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug stdio/16618] New: wscanf allocates too little memory
@ 2014-02-21  1:10 jsm28 at gcc dot gnu.org
  2014-06-13  8:11 ` [Bug stdio/16618] " fweimer at redhat dot com
                   ` (12 more replies)
  0 siblings, 13 replies; 14+ messages in thread
From: jsm28 at gcc dot gnu.org @ 2014-02-21  1:10 UTC (permalink / raw)
  To: glibc-bugs

https://sourceware.org/bugzilla/show_bug.cgi?id=16618

            Bug ID: 16618
           Summary: wscanf allocates too little memory
           Product: glibc
           Version: 2.19
            Status: NEW
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: jsm28 at gcc dot gnu.org

stdio-common/vfscanf.c has an ADDW macro that tries to determine whether to use
malloc or alloca for allocations.  But in the malloc case, it only allocates
newsize bytes instead of the required newsize * sizeof (CHAR_T).  Thus the
allocated buffer gets overrun in the wide-string case, as shown by the
following testcase:

#include <stdlib.h>
#include <wchar.h>

#define SIZE 131072

int
main (void)
{
  wchar_t *s = malloc ((SIZE + 1) * sizeof (*s));
  if (s == NULL)
    abort ();
  for (size_t i = 0; i < SIZE; i++)
    s[i] = L'0';
  s[SIZE] = L'\0';
  int i;
  if (swscanf (s, L"%d", &i) != 1)
    abort ();
  if (i != 0)
    abort ();
  free (s);
  return 0;
}

I expect this should be considered a security issue and get a CVE allocated.

The logic also has a problem that the comparison UCHAR_MAX + 1 > 2 * wpmax
doesn't allow for 2 * wpmax overflowing, though that would only apply if half
the address space gets allocated.  The check with __libc_use_alloca also checks
against the number of array entries to allocate rather than the number of
bytes, so the function can allocate up to four times as many bytes as is libc
policy on the stack in the wide character case.

-- 
You are receiving this mail because:
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 14+ messages in thread
end of thread, other threads:[~2015-07-21  3:17 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-02-21  1:10 [Bug stdio/16618] New: wscanf allocates too little memory jsm28 at gcc dot gnu.org
2014-06-13  8:11 ` [Bug stdio/16618] " fweimer at redhat dot com
2015-02-01 20:13 ` ppluzhnikov at google dot com
2015-02-02 20:57 ` michael.tremer at ipfire dot org
2015-02-04 10:02 ` [Bug stdio/16618] wscanf allocates too little memory (CVE-2015-1472) fweimer at redhat dot com
2015-02-06  5:52 ` cvs-commit at gcc dot gnu.org
2015-02-06  5:53 ` carlos at redhat dot com
2015-02-06  8:20 ` [Bug stdio/16618] wscanf allocates too little memory (CVE-2015-1472, CVE-2015-1473) fweimer at redhat dot com
2015-02-17  7:25 ` cvs-commit at gcc dot gnu.org
2015-02-23 14:06 ` cvs-commit at gcc dot gnu.org
2015-02-23 14:23 ` cvs-commit at gcc dot gnu.org
2015-02-23 15:02 ` cvs-commit at gcc dot gnu.org
2015-02-26  9:21 ` fweimer at redhat dot com
2015-07-21  3:17 ` vapier at gentoo dot org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).