mirror of
https://sourceware.org/git/glibc.git
synced 2024-11-08 14:20:07 +00:00
syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
__vsyslog_internal calculated a buffer size by adding two integers, but did not first check if the addition would overflow. This commit fixes that. Reviewed-by: Carlos O'Donell <carlos@redhat.com> Tested-by: Carlos O'Donell <carlos@redhat.com>
This commit is contained in:
parent
7e5a0c286d
commit
ddf542da94
@ -41,6 +41,7 @@ static char sccsid[] = "@(#)syslog.c 8.4 (Berkeley) 3/18/94";
|
||||
#include <sys/uio.h>
|
||||
#include <sys/un.h>
|
||||
#include <syslog.h>
|
||||
#include <limits.h>
|
||||
|
||||
static int LogType = SOCK_DGRAM; /* type of socket connection */
|
||||
static int LogFile = -1; /* fd for log */
|
||||
@ -219,7 +220,7 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap,
|
||||
vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags);
|
||||
va_end (apc);
|
||||
|
||||
if (vl < 0)
|
||||
if (vl < 0 || vl >= INT_MAX - l)
|
||||
goto out;
|
||||
|
||||
if (vl >= len)
|
||||
|
Loading…
Reference in New Issue
Block a user