[Bug stdio/17916] New: fopen unbounded stack usage for ccs= modes

[Bug stdio/17916] New: fopen unbounded stack usage for ccs= modes

[jsm28 at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17916

            Bug ID: 17916
           Summary: fopen unbounded stack usage for ccs= modes
           Product: glibc
           Version: 2.21
            Status: NEW
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: jsm28 at gcc dot gnu.org

When the ",ccs=" notation is used with fopen to specify a character set
conversion, a copy of the character set name is made on the stack with no
bounds on the stack allocation: (from libio/fileops.c)

          char *endp = __strchrnul (cs + 5, ',');
          char ccs[endp - (cs + 5) + 3];

          *((char *) __mempcpy (ccs, cs + 5, endp - (cs + 5))) = '\0';

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug stdio/17916] fopen unbounded stack usage for ccs= modes

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=17916

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug stdio/17916] fopen unbounded stack usage for ccs= modes

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=17916

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug stdio/17916] fopen unbounded stack usage for ccs= modes

[ppluzhnikov at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=17916

Paul Pluzhnikov <ppluzhnikov at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ppluzhnikov at google dot com
           Assignee|unassigned at sourceware dot org   |ppluzhnikov at google dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug stdio/17916] fopen unbounded stack usage for ccs= modes

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17916

--- Comment #1 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  6909d2767580b680138a6aa49aabf4976770e9f6 (commit)
      from  65f6f938cd562a614a68e15d0581a34b177ec29d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6909d2767580b680138a6aa49aabf4976770e9f6

commit 6909d2767580b680138a6aa49aabf4976770e9f6
Author: Paul Pluzhnikov <ppluzhnikov@google.com>
Date:   Tue Feb 24 08:05:34 2015 -0800

    Fix BZ #17916 - fopen unbounded stack usage for ccs= modes

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog            |    6 ++++++
 NEWS                 |    4 ++--
 libio/fileops.c      |   13 ++++++++++++-
 libio/tst-fopenloc.c |   28 +++++++++++++++++++++++++++-
 4 files changed, 47 insertions(+), 4 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug stdio/17916] fopen unbounded stack usage for ccs= modes

[ppluzhnikov at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=17916

Paul Pluzhnikov <ppluzhnikov at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from Paul Pluzhnikov <ppluzhnikov at google dot com> ---
Fixed by 6909d2767580b680138a6aa49aabf4976770e9f6

-- 
You are receiving this mail because:
You are on the CC list for the bug.