[Bug libc/34506] New: Out-of-bounds stack array access in tdelete

https://sourceware.org/bugzilla/show_bug.cgi?id=34506

            Bug ID: 34506
           Summary: Out-of-bounds stack array access in tdelete
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---
             Flags: security?

Created attachment 16921
  --> https://sourceware.org/bugzilla/attachment.cgi?id=16921&action=edit
RHEL-218587.html

Red Hat Product Security has asked me to forward the attached vulnerability
report. I'm not sure if it really qualifies as a vulnerability. It seems hardly
exploitable.

The problem is that after the descent phase, one more element can be pushed
onto the explicit stack, and this is done without any bounds checking.

My preferred fix would be to do away with the alloca and allocate the maximum
possible array size statically, based on the maximum depth of a red-black tree
and the theoretically available address space.

-- 
You are receiving this mail because:
You are on the CC list for the bug.