[Bug stdio/26211] New: printf integer overflow calculating allocation size

["jsm28 at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26211

            Bug ID: 26211
           Summary: printf integer overflow calculating allocation size
           Product: glibc
           Version: 2.32
            Status: NEW
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: jsm28 at gcc dot gnu.org
  Target Milestone: ---

The following test segfaults on a 64-bit system (haven't tested 32-bit).  (Any
precision less than 0x7fffffe0 is OK; 0x7fffffe0 through 0x7fffffff result in
the crash.)

#include <stdio.h>
#include <stdlib.h>

int
main (void)
{
  FILE *fp;
  if ((fp = fopen ("/dev/null", "w")) == NULL)
    exit (1);
  fprintf (fp, "%2$.*1$a", 0x7fffffff, 1e200);
}

The problem is the code in printf_positional:

      /* Maybe the buffer is too small.  */
      if (MAX (prec, width) + EXTSIZ > WORK_BUFFER_SIZE)
        {
          if (__libc_use_alloca ((MAX (prec, width) + EXTSIZ)
                                 * sizeof (CHAR_T)))
            workend = ((CHAR_T *) alloca ((MAX (prec, width) + EXTSIZ)
                                          * sizeof (CHAR_T))
                       + (MAX (prec, width) + EXTSIZ));
          else
            {
              workstart = (CHAR_T *) malloc ((MAX (prec, width) + EXTSIZ)
                                             * sizeof (CHAR_T));
              if (workstart == NULL)
                {
                  done = -1;
                  goto all_done;
                }
              workend = workstart + (MAX (prec, width) + EXTSIZ);
            }
        }

The code in the implementation that doesn't use '$' argument numbers has a
check

        if (__glibc_unlikely (width >= INT_MAX / sizeof (CHAR_T) - EXTSIZ))
          {
            __set_errno (EOVERFLOW);
            done = -1;
            goto all_done;
          }

(and likewise for precision). The implementation for the case with '$' argument
numbers is missing that check. So MAX (prec, width) + EXTSIZ overflows.

-- 
You are receiving this mail because:
You are on the CC list for the bug.