lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-08 17:42:12 +03:00
Code Activity

Fix integer overflow in vfwprintf. Fixes bug 14286.

Browse Source
This commit is contained in:
Ondřej Bílka
2014-01-07 12:02:15 +01:00
parent b513cbf751
commit 94c8a4bc57
3 changed files with 26 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@@ -1,3 +1,8 @@
2014-01-07 Ondřej Bílka <neleai@seznam.cz>
[BZ #14286]
* stdio-common/vfprintf.c: Check for integer overflow.
2014-01-07 Andreas Krebbel <Andreas.Krebbel@de.ibm.com> 2014-01-07 Andreas Krebbel <Andreas.Krebbel@de.ibm.com>
* sysdeps/s390/dl-tls.h: sysdeps/s390/dl-tls.h: Remove casts for * sysdeps/s390/dl-tls.h: sysdeps/s390/dl-tls.h: Remove casts for

28
NEWS
View File

@@ -11,20 +11,20 @@ Version 2.19
156, 387, 431, 762, 832, 926, 2801, 4772, 6786, 6787, 6807, 6810, 7003, 156, 387, 431, 762, 832, 926, 2801, 4772, 6786, 6787, 6807, 6810, 7003,
9954, 10253, 10278, 11087, 11157, 11214, 12100, 12486, 12986, 13028, 9954, 10253, 10278, 11087, 11157, 11214, 12100, 12486, 12986, 13028,
13982, 13985, 14029, 14032, 14120, 14143, 14155, 14547, 14699, 14752, 13982, 13985, 14029, 14032, 14120, 14143, 14155, 14286, 14547, 14699,
14876, 14910, 15004, 15048, 15073, 15089, 15128, 15218, 15268, 15277, 14752, 14876, 14910, 15004, 15048, 15073, 15089, 15128, 15218, 15268,
15308, 15362, 15374, 15400, 15425, 15427, 15483, 15522, 15531, 15532, 15277, 15308, 15362, 15374, 15400, 15425, 15427, 15483, 15522, 15531,
15593, 15601, 15608, 15609, 15610, 15632, 15640, 15670, 15672, 15680, 15532, 15593, 15601, 15608, 15609, 15610, 15632, 15640, 15670, 15672,
15681, 15723, 15734, 15735, 15736, 15748, 15749, 15754, 15760, 15763, 15680, 15681, 15723, 15734, 15735, 15736, 15748, 15749, 15754, 15760,
15764, 15797, 15799, 15825, 15843, 15844, 15846, 15847, 15849, 15855, 15763, 15764, 15797, 15799, 15825, 15843, 15844, 15846, 15847, 15849,
15856, 15857, 15859, 15867, 15886, 15887, 15890, 15892, 15893, 15895, 15855, 15856, 15857, 15859, 15867, 15886, 15887, 15890, 15892, 15893,
15897, 15901, 15905, 15909, 15915, 15917, 15919, 15921, 15923, 15939, 15895, 15897, 15901, 15905, 15909, 15915, 15917, 15919, 15921, 15923,
15941, 15948, 15963, 15966, 15985, 15988, 15997, 16032, 16034, 16036, 15939, 15941, 15948, 15963, 15966, 15985, 15988, 15997, 16032, 16034,
16037, 16038, 16041, 16055, 16071, 16072, 16074, 16077, 16078, 16103, 16036, 16037, 16038, 16041, 16055, 16071, 16072, 16074, 16077, 16078,
16112, 16143, 16144, 16146, 16150, 16151, 16153, 16167, 16172, 16195, 16103, 16112, 16143, 16144, 16146, 16150, 16151, 16153, 16167, 16172,
16214, 16245, 16271, 16274, 16283, 16289, 16293, 16314, 16316, 16330, 16195, 16214, 16245, 16271, 16274, 16283, 16289, 16293, 16314, 16316,
16337, 16338, 16356, 16365, 16366, 16369, 16372, 16375, 16379, 16384, 16330, 16337, 16338, 16356, 16365, 16366, 16369, 16372, 16375, 16379,
16385, 16386, 16390, 16400. 16384, 16385, 16386, 16390, 16400.
* Slovenian translations for glibc messages have been contributed by the * Slovenian translations for glibc messages have been contributed by the
Translation Project's Slovenian team of translators. Translation Project's Slovenian team of translators.

8
stdio-common/vfprintf.c
View File

@@ -1067,7 +1067,13 @@ vfprintf (FILE *s, const CHAR_T *format, va_list ap)
/* Allocate dynamically an array which definitely is long \ /* Allocate dynamically an array which definitely is long \
enough for the wide character version. Each byte in the \ enough for the wide character version. Each byte in the \
multi-byte string can produce at most one wide character. */ \ multi-byte string can produce at most one wide character. */ \
if (__libc_use_alloca (len * sizeof (wchar_t))) \ if (__glibc_unlikely (len > SIZE_MAX / sizeof (wchar_t))) \
{ \
__set_errno (EOVERFLOW); \
done = -1; \
goto all_done; \
} \
else if (__libc_use_alloca (len * sizeof (wchar_t))) \
string = (CHAR_T *) alloca (len * sizeof (wchar_t)); \ string = (CHAR_T *) alloca (len * sizeof (wchar_t)); \
else if ((string = (CHAR_T *) malloc (len * sizeof (wchar_t))) \ else if ((string = (CHAR_T *) malloc (len * sizeof (wchar_t))) \
== NULL) \ == NULL) \