[bug #68534] heap-buffer-overflow in ansicstr/bexpand: size_t to int truncation allocates 12-byte buffer for ~2 GB write

--8323329-1714636915-1784300572=:81713
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline

URL:=0A  <https://savannah.gnu.org/bugs/?68534>=0A=0A                 Summa=
ry: heap-buffer-overflow in ansicstr/bexpand: size_t to=0Aint truncation al=
locates 12-byte buffer for ~2 GB write=0A                   Group: The GNU =
Bourne-Again SHell=0A               Submitter: gerben_altlinux=0A          =
     Submitted: =D0=9F=D1=82 17 =D0=B8=D1=8E=D0=BB 2026 15:02:47=0A        =
        Category: None=0A                Severity: 3 - Normal=0A           =
     Priority: 5 - Normal=0A              Item Group: None=0A              =
    Status: None=0A                 Privacy: Private=0A             Assigne=
d to: None=0A             Open/Closed: Open=0A         Discussion Lock: Unl=
ocked=0A=0A=0A    _______________________________________________________=
=0A=0AFollow-up Comments:=0A=0A=0A-----------------------------------------=
--------------=0ADate: =D0=9F=D1=82 17 =D0=B8=D1=8E=D0=BB 2026 15:02:47   B=
y: Denis Rastyogin <gerben_altlinux>=0AIn ansicstr() (lib/sh/strtrans.c:68)=
 and bexpand() (builtins /printf.def:1199)=0Athe output buffer size is stor=
ed in int temp:=0A=0A    int c, temp;=0A    ...=0A    temp =3D 4*len + 4;  =
 /* len is size_t */=0A    if (temp < 12)=0A        temp =3D 12;=0A    ret =
=3D (char *)xmalloc(temp);=0A=0AWhen len >=3D 536870912 (~512 MB), 4*len+4 =
overflows int32, the < 12 guard=0Afires, xmalloc(12) allocates 12 bytes. Th=
e copy loop then writes up to len=0Abytes into that buffer, corrupting the =
heap and leading to SIGSEGV.=0A=0A    python3 -c "import sys; sys.stdout.bu=
ffer.write(b'A'*536870912)" >=0A/tmp/poc.bin=0A    bash -c 'v=3D$(cat /tmp/=
poc.bin); printf "%b" "$v"'=0A=0ARCE: tested with ASLR=3D0, --with-bash-mal=
loc, heap layout determined via GDB.=0Abash_malloc free-list pointers are u=
nobfuscated; the linear overwrite=0Areaches SHELL_VAR.dynamic_value and rep=
laces it with system().=0A=0AFound by Denis Rastyogin <[email protected]>=
 (ALT Linux).=0A=0A=0A=0A=0A=0A=0A=0A    __________________________________=
_____________________=0A=0AReply to this item at:=0A=0A  <https://savannah.=
gnu.org/bugs/?68534>=0A=0A_______________________________________________=
=0A=D0=A1=D0=BE=D0=BE=D0=B1=D1=89=D0=B5=D0=BD=D0=B8=D0=B5 =D0=BE=D1=82=D0=
=BF=D1=80=D0=B0=D0=B2=D0=BB=D0=B5=D0=BD=D0=BE =D0=BF=D0=BE Savannah=0Ahttps=
://savannah.gnu.org/=0A
--8323329-1714636915-1784300572=:81713
Content-Type: APPLICATION/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCalpEHAAKCRCqLAuaBUf3
TlS0AP4ifz3Yb9IJ1CuKDAJINAT07DYRgKd+Q2oGYpou6izQuQD/cTeioExwqLS7
tWhX1cSuV6FjMwFwyARM17uEagLZvAY=
=P1Pn
-----END PGP SIGNATURE-----

--8323329-1714636915-1784300572=:81713--