[Bug stdio/34531] New: vfscanf wide string size overflow in glibc 2.29 (and with interposed malloc)

https://sourceware.org/bugzilla/show_bug.cgi?id=34531

            Bug ID: 34531
           Summary: vfscanf wide string size overflow in glibc 2.29 (and
                    with interposed malloc)
           Product: glibc
           Version: 2.29
            Status: NEW
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security+

Created attachment 16945
  --> https://sourceware.org/bugzilla/attachment.cgi?id=16945&action=edit
RHEL-215295.html

The realloc calls in vfscanf for wide strings have an integer
wrapround/overflow in the size computation. These calls should be replaced with
reallocarray.

I'm required to mention: Found by AISLE in partnership with Red Hat

Only in glibc 2.29 and earlier, this is actually reachable. In glibc 2.30 and
later, we have this:

commit 9bf8e29ca136094f73f69f725f15c51facc97206
Author: Adhemerval Zanella <[email protected]>
Date:   Tue Dec 18 16:30:56 2018 -0200

    malloc: make malloc fail with requests larger than PTRDIFF_MAX (BZ#23741)

So the code hits the realloc-by-one character path instead instead of
performing a size-reducing realloc.

-- 
You are receiving this mail because:
You are on the CC list for the bug.