From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 15546 invoked by alias); 30 Jan 2016 10:45:15 -0000 Mailing-List: contact libc-stable-help@sourceware.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Subscribe: List-Archive: Sender: libc-stable-owner@sourceware.org Received: (qmail 15528 invoked by uid 89); 30 Jan 2016 10:45:14 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Checked: by ClamAV 0.99 on sourceware.org X-Virus-Found: No X-Spam-SWARE-Status: No, score=1.0 required=5.0 tests=BAYES_40,KAM_LAZY_DOMAIN_SECURITY,RP_MATCHES_RCVD autolearn=no version=3.3.2 spammy=2015-10-27, 20151027, courts, Courts X-Spam-Status: No, score=1.0 required=5.0 tests=BAYES_40,KAM_LAZY_DOMAIN_SECURITY,RP_MATCHES_RCVD autolearn=no version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sourceware.org X-Spam-Level: X-HELO: hall.aurel32.net From: Aurelien Jarno To: libc-stable@sourceware.org Cc: =?UTF-8?q?Ond=C5=99ej=20B=C3=ADlka?= Subject: [COMMITTED 2.22] Handle overflow in __hcreate_r Date: Fri, 01 Jan 2016 00:00:00 -0000 Message-Id: <1454150677-7735-1-git-send-email-aurelien@aurel32.net> X-Mailer: git-send-email 2.7.0.rc3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SW-Source: 2016-01/txt/msg00012.txt.bz2 From: Ondřej Bílka Hi, As in bugzilla entry there is overflow in hsearch when looking for prime number as SIZE_MAX - 1 is divisible by 5. We fix that by rejecting large inputs before looking for prime. * misc/hsearch_r.c (__hcreate_r): Handle overflow. (cherry picked from commit 2f5c1750558fe64bac361f52d6827ab1bcfe52bc) --- ChangeLog | 5 +++++ misc/hsearch_r.c | 9 ++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 9740c89..e818995 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +2015-08-25 Ondřej Bílka + + [BZ #18240] + * misc/hsearch_r.c (__hcreate_r): Handle overflow. + 2015-10-27 Ludovic Courtès * locale/loadlocale.c (_nl_intern_locale_data): Change assertion diff --git a/misc/hsearch_r.c b/misc/hsearch_r.c index 9f55e84..559df29 100644 --- a/misc/hsearch_r.c +++ b/misc/hsearch_r.c @@ -19,7 +19,7 @@ #include #include #include - +#include #include /* [Aho,Sethi,Ullman] Compilers: Principles, Techniques and Tools, 1986 @@ -73,6 +73,13 @@ __hcreate_r (nel, htab) return 0; } + if (nel >= SIZE_MAX / sizeof (_ENTRY)) + { + __set_errno (ENOMEM); + return 0; + } + + /* There is still another table active. Return with error. */ if (htab->table != NULL) return 0; -- 2.7.0.rc3