[Bug libc/34506] Out-of-bounds stack array access in tdelete (CVE-2026-19542)
fweimer at redhat dot com via Glibc-bugs <[email protected]>
| Newsgroups | gmane.comp.lib.glibc.bugs |
|---|---|
| Message-ID | <[email protected]/bugzilla/> |
https://sourceware.org/bugzilla/show_bug.cgi?id=34506
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Target Milestone|--- |2.45
Resolution|--- |FIXED
--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for 2.45 via:
commit e2789c46e3bfdcd67a82bea9946b315c179e83d3
Author: Florian Weimer <[email protected]>
Date: Fri Aug 14 13:41:16 2026 +0200
misc: Fix out-of-bounds array write in tdelete (bug 34506)
Allocate the maximum array sizes directly, instead of resizing
the arrays as needed. This eliminates alloca usage from the
function, and fixes the out-of-bounds accesses. The asserts
guard against the bug coming back if the balancing of the tree
turns out not to work correctly.
Reviewed-by: Adhemerval Zanella <[email protected]>
--
You are receiving this mail because:
You are on the CC list for the bug.