AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-12-24 11:41:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix OOB read in stdlib thousand separator handling

Browse Source 
__correctly_grouped_prefixmb only worked with thousands_len == 1,
otherwise it read past the end of cp or thousands.

Avoid OOB access by considering thousands_len when initializing cp.

On morello with strict bounds checking this fixes

FAIL: stdlib/tst-strtod4
FAIL: stdlib/tst-strtod5i

both of which set cs_CZ.UTF-8 locale that has 3 byte thousands_len.
This commit is contained in:
Szabolcs Nagy 2022-10-11 15:24:41 +01:00
parent 059dd1983c
commit 85c6eba32a
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
stdlib/grouping.c
View File

@ -64,9 +64,17 @@ __correctly_grouped_prefixmb (const STRING_TYPE *begin, const STRING_TYPE *end,
thousands_len = strlen (thousands);
#endif
#ifdef USE_WIDE_CHAR
while (end > begin)
#else
while (end - begin >= thousands_len)
#endif
{
#ifdef USE_WIDE_CHAR
const STRING_TYPE *cp = end - 1;
#else
const STRING_TYPE *cp = end - thousands_len;
#endif
const char *gp = grouping;
/* Check first group. */