[Bug libc/25620] Signed comparison vulnerability in the ARMv7 memcpy()

["adhemerval.zanella at linaro dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=25620

Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |adhemerval.zanella at linaro dot o
                   |                            |rg

--- Comment #4 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
(In reply to Yves Younan from comment #2)
> Joseph, the bug is in memcpy, not malloc.

My understanding from Joseph's reply is that using a value higher than
PTRDIFF_MAX for memcpy length is undefined behavior because either for
automatic objects or by using memory allocation functions the allocation will
fail. 

However, I still think it is an issue because we explicit omit mmap from the
allocation functions that might fail (if I recall correctly the reason was that
some programs do try to allocate more than PTRDIFF_MAX with mmap). It will be
still subject to the undefined behavior with pointer subtraction when operating
with the object itself, so maybe we should extend the same failure handling to
mmap.

-- 
You are receiving this mail because:
You are on the CC list for the bug.