lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-08-01 10:06:57 +03:00
Code Activity

CVE-2012-3406: Stack overflow in vfprintf [BZ #16617]

Browse Source 
A larger number of format specifiers coudld cause a stack overflow,
potentially allowing to bypass _FORTIFY_SOURCE format string
protection.
This commit is contained in:
Jeff Law
2014-12-15 10:09:32 +01:00
committed by Florian Weimer
parent 3a12c70f13
commit a5357b7ce2
7 changed files with 207 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
stdio-common/bug23-2.c Normal file
View File

@ -0,0 +1,70 @@
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
static const char expected[] = "\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55\
\n\
a\n\
abbcd55%%%%%%%%%%%%%%%%%%%%%%%%%%\n";
static int
do_test (void)
{
char *buf = malloc (strlen (expected) + 1);
snprintf (buf, strlen (expected) + 1,
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
"%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n",
"a", "b", "c", "d", 5);
return strcmp (buf, expected) != 0;
}
#define TEST_FUNCTION do_test ()
#include "../test-skeleton.c"