[Bug malloc/34518] New: Integer overflow in _nl_intern_locale_data() on x86

https://sourceware.org/bugzilla/show_bug.cgi?id=34518

            Bug ID: 34518
           Summary: Integer overflow in _nl_intern_locale_data() on x86
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: barkadevaibhav491 at gmail dot com
  Target Milestone: ---

Dear glibc maintainers,

I have discovered a confirmed integer overflow vulnerability in the
GNU C Library function _nl_intern_locale_data(), triggered via the
locale-loading subsystem on 32-bit architectures (i386, armv7).

System Information:
- Architecture: i386 (also affects armv7)
- glibc version: 2.36-9+deb12u8 (Debian 12 i386) - Confirmed
- Kernel version: 6.1.0-23-686-pae (Debian 12 i386)
- Distribution: Debian 12 (Bookworm) i386
- Compiler: gcc 12.2.0

Affected Function:
_nl_intern_locale_data() in locale/loadlocale.c

Description of the Bug:
When _nl_intern_locale_data() processes a crafted locale binary, an
integer overflow occurs during arithmetic that calculates memory
allocation sizes or index offsets within the locale data structure.
The overflow takes place when the size calculation for the locale
data exceeds the maximum representable value in a 32-bit integer
(signed or unsigned). This results in undersized heap allocations
followed by out-of-bounds writes, leading to heap corruption.

Specifically, the overflow occurs in the following calculation:
[If you have the exact line/variable, insert it here, e.g.:
"n_elem = (uint32_t) *(const uint32_t *) (p) * sizeof(struct foo)"
When n_elem is large enough, the multiplication wraps around to a
small value, causing an undersized allocation via malloc()/calloc().]

This leads to a classic heap buffer overflow where data is written
past the allocated buffer boundary, corrupting heap metadata or
overwriting adjacent objects.

Steps to Reproduce:
1. Compile the attached proof-of-concept with:
   gcc -o poc poc.c -Wall -Wextra -m32

2. Set the LOCPATH environment variable to the directory containing
   the crafted locale binary:
   export LOCPATH=./

3. Run the PoC:
   ./poc

4. Observe the crash:
   *** stack smashing detected ***: terminated
   Aborted (core dumped)
   Exit code: 134 (SIGABRT)

Expected Behavior:
_nl_intern_locale_data() should validate the locale data size before
performing arithmetic operations. If the data is malformed, the
function should return NULL and set errno to EINVAL or ENOMEM without
corrupting memory.

Actual Behavior:
The function performs the overflowed arithmetic, allocates an
insufficiently sized heap buffer, and subsequently writes beyond the
buffer boundary, corrupting heap metadata and causing a crash
(SIGABRT) during heap consistency checks.

-- 
You are receiving this mail because:
You are on the CC list for the bug.