AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-12-13 06:40:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
16245986fb
glibc/misc/sys
History
Joan Bruguera ca0faa140f misc: Fix rare fortify crash on wchar funcs. [BZ 29030] 
If `__glibc_objsize (__o) == (size_t) -1` (i.e. `__o` is unknown size), fortify
checks should pass, and `__whatever_alias` should be called.

Previously, `__glibc_objsize (__o) == (size_t) -1` was explicitly checked, but
on commit a643f60c53, this was moved into `__glibc_safe_or_unknown_len`.

A comment says the -1 case should work as: "The -1 check is redundant because
since it implies that __glibc_safe_len_cond is true.". But this fails when:
* `__s > 1`
* `__osz == -1` (i.e. unknown size at compile time)
* `__l` is big enough
* `__l * __s <= __osz` can be folded to a constant
(I only found this to be true for `mbsrtowcs` and other functions in wchar2.h)

In this case `__l * __s <= __osz` is false, and `__whatever_chk_warn` will be
called by `__glibc_fortify` or `__glibc_fortify_n` and crash the program.

This commit adds the explicit `__osz == -1` check again.
moc crashes on startup due to this, see: https://bugs.archlinux.org/task/74041

Minimal test case (test.c):
    #include <wchar.h>

    int main (void)
    {
        const char *hw = "HelloWorld";
        mbsrtowcs (NULL, &hw, (size_t)-1, NULL);
        return 0;
    }

Build with:
    gcc -O2 -Wp,-D_FORTIFY_SOURCE=2 test.c -o test && ./test

Output:
    *** buffer overflow detected ***: terminated

Fixes: BZ #29030
Signed-off-by: Joan Bruguera <joanbrugueram@gmail.com>
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
(cherry picked from commit 33e03f9cd2)
2022-04-25 18:44:27 +05:30
..
auxv.h Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
cdefs.h misc: Fix rare fortify crash on wchar funcs. [BZ 29030] 2022-04-25 18:44:27 +05:30
dir.h Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
file.h Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
ioctl.h Linux: Fix fcntl, ioctl, prctl redirects for _TIME_BITS=64 (bug 28182) 2021-08-06 16:42:40 +02:00
mman.h Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
param.h Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
queue.h [BZ #5779] 2008-03-05 05:50:39 +00:00
select.h y2038: Add support for 64-bit time on legacy ABIs 2021-06-15 10:42:11 -03:00
single_threaded.h Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
syslog.h Rename __LONG_DOUBLE_USES_FLOAT128 to __LDOUBLE_REDIRECTS_TO_FLOAT128_ABI 2020-04-30 08:52:08 -05:00
sysmacros.h Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00
uio.h Annotate additional APIs with GCC attribute access. 2021-05-06 11:01:05 -06:00
xattr.h Update copyright dates with scripts/update-copyrights 2021-01-02 12:17:34 -08:00