[Bug libc/29536] syslog fail to create large messages

["siddhesh at sourceware dot org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=29536

--- Comment #3 from Siddhesh Poyarekar <siddhesh at sourceware dot org> ---
OK, some more analysis on what's going on:

There are two invalid reads here:

    __dprintf (STDERR_FILENO, "%s%s", buf + msgoff,
               "\n" + (buf[bufsize - 1] == '\n')); 

one that's a byte under the malloc'd block, through buf[bufsize - 1].  The
other is a read of uninitialized memory through buf + msgoff, which will end up
revealing contents of buf if it has been reused.  At best it will reveal a free
list pointer, which we mangle, so that's less of a problem.  At worst it could
be a block of interest for the attacker.

The byte under the malloc'd block is less interesting because it is merely used
to decide whether or not to print the '\n'.

So I'm going to leave the security+ in place and file a CVE request.  The fix
should get backported to 2.36, where the flaw was introduced.

-- 
You are receiving this mail because:
You are on the CC list for the bug.