[Bug stdio/34531] vfscanf wide string size overflow in glibc 2.29 (and with interposed malloc)
fweimer at redhat dot com via Glibc-bugs <[email protected]>
| Newsgroups | gmane.comp.lib.glibc.bugs |
|---|---|
| Message-ID | <[email protected]/bugzilla/> |
https://sourceware.org/bugzilla/show_bug.cgi?id=34531
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |RESOLVED
Target Milestone|--- |2.45
Resolution|--- |FIXED
--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for glibc 2.45 via:
commit b2d944913a6454ca3d30f4c5b57fa8130cc090ce
Author: Florian Weimer <[email protected]>
Date: Thu Aug 20 09:20:55 2026 +0200
stdio-common: Use reallocarray for wide strings in vfscanf (bug 34531)
This avoids theoretical integer overflow issues on 32-bit
architectures. The overflow is not reachable since glibc 2.30
because doubling reaches a size larger than PTRDIFF_MAX, at which
point realloc fails due to commit 9bf8e29ca136094f73f6 ("malloc:
make malloc fail with requests larger than PTRDIFF_MAX (BZ#23741)").
The non-doubling path is used instead. Eventually, the size
increments also pass PTRDIFF_MAX, so the fallback realloc fails, too.
This means that in current glibc, there is no crash.
Reviewed-by: Collin Funk <[email protected]>
--
You are receiving this mail because:
You are on the CC list for the bug.