[Bug libc/7066] Probable buffer overrun in strtold()

[Bug libc/7066] Probable buffer overrun in strtold()

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=7066

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
              Flags|                            |security+

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/7066] Probable buffer overrun in strtold()

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2010-09-01 19:40 -------
Should be handled in git.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=7066

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/7066] Probable buffer overrun in strtold()

[nix at esperi dot org dot uk]

------- Additional Comments From nix at esperi dot org dot uk  2008-12-05 00:17 -------
It's using the same compile line that glibc's 'make check' uses, which 
passes -std=gnu99 (IIRC: I don't have a build tree at the right point to verify 
this right now).

The original testcase in glibc calls strtold() with many different inputs: only 
this one crashes under -fstack-protector-all, and the corrupted stack is not in 
the testing function but within glibc itself. So I don't see how e.g. pointer 
width differences (not applicable on x86-32 anyway as far as I can see) could 
cause a problem. It's not as if this is a varargs function on AIX or something.

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=7066

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/7066] Probable buffer overrun in strtold()

[pasky at suse dot cz]

------- Additional Comments From pasky at suse dot cz  2008-12-04 14:08 -------
Are you compiling with -std=c99 or similar? (i.e. do you have the correct
prototype?)

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=7066

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/7066] Probable buffer overrun in strtold()

[nix at esperi dot org dot uk]

------- Additional Comments From nix at esperi dot org dot uk  2008-12-04 12:12 -------
Created an attachment (id=3090)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=3090&action=view)
One-liner reproducing the crash

Backtrace with this one-liner, with glibc compiled with -fstack-protector-all:

Program received signal SIGABRT, Aborted.
0xb804a424 in __kernel_vsyscall ()
(gdb) bt
#0  0xb804a424 in __kernel_vsyscall ()
#1  0x08054a4b in __stack_chk_fail () at stack_chk_fail.c:295
#2  0x0804ad96 in ____strtold_l_internal (nptr=0x80ad488 "42.", '0' <repeats 19
times>, "1", endptr=0x0, group=0, loc=0x80cb0a0) at ../stdlib/strtod_l.c:1571
#3  0x08048cb7 in strtold (nptr=0x80ad488 "42.", '0' <repeats 19 times>, "1",
endptr=0x0) at strtod.c:70
#4  0x08048255 in main (argc=1, argv=0xbfa47364) at strtold-crash.c:7


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=7066

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.