[Bug stdio/34008] stdio-common: scanf %mc pattern will cause heap overflow when width > 1024

"cvs-commit at gcc dot gnu.org via Glibc-bugs" <[email protected]> Tue, 23 Jun 2026 04:38:50 +0000

Newsgroups	gmane.comp.lib.glibc.bugs
Message-ID	<[email protected]/bugzilla/>

https://sourceware.org/bugzilla/show_bug.cgi?id=34008

--- Comment #7 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The release/2.41/master branch has been updated by Aurelien Jarno
<[email protected]>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1a74f82eedaf0987eda1f522121e6a48fac502e7

commit 1a74f82eedaf0987eda1f522121e6a48fac502e7
Author: Rocket Ma <[email protected]>
Date:   Fri Apr 17 23:48:41 2026 -0700

    stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

    * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
    format %mc or %mC, glibc allocates one byte less, leading to
    user-controlled one byte overflow. This commit fixes BZ #34008, or
    CVE-2026-5450.

    Reviewed-by: Carlos O'Donell <[email protected]>
    Signed-off-by: Rocket Ma <[email protected]>
    Reviewed-by: H.J. Lu <[email protected]>
    (cherry picked from commit 839898777226a3ed88c0859f25ffe712519b4ead)

-- 
You are receiving this mail because:
You are on the CC list for the bug.