Go to file
Arjun Shankar 6bd0e4efcc syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246)
__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
containing a long program name failed to update the required buffer
size, leading to the allocation and overflow of a too-small buffer on
the heap.  This commit fixes that.  It also adds a new regression test
that uses glibc.malloc.check.

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Tested-by: Carlos O'Donell <carlos@redhat.com>
2024-01-30 15:53:37 +01:00
advisories Move CVE information into advisories directory 2023-12-07 12:31:23 -05:00
argp Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
assert Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
benchtests Benchtests: Increase benchmark iterations 2024-01-12 16:00:28 +00:00
bits Implement C23 <stdbit.h> 2024-01-03 12:07:14 +00:00
catgets Update copyright dates not handled by scripts/update-copyrights 2024-01-01 10:53:40 -08:00
ChangeLog.old Create ChangeLog.old/ChangeLog.27 2023-07-30 21:45:27 +02:00
conform Remove ia64-linux-gnu 2024-01-08 17:09:36 -03:00
csu Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
ctype Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
debug debug/getwd_chk.c: warning should be emitted for the __getwd_chk symbol. 2024-01-12 15:21:26 +01:00
dirent Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
dlfcn Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
elf elf: correct relocation statistics for !ELF_MACHINE_START_ADDRESS 2024-01-29 18:27:35 +01:00
gmon Remove ia64-linux-gnu 2024-01-08 17:09:36 -03:00
gnulib Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
hesiod Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
htl Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
hurd hurd: Declare _hurd_intr_rpc_msg* with protected visibility 2024-01-03 21:59:54 +01:00
iconv Update copyright dates not handled by scripts/update-copyrights 2024-01-01 10:53:40 -08:00
iconvdata Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
include Implement C23 <stdbit.h> 2024-01-03 12:07:14 +00:00
inet Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
intl Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
io Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
libio libio: Check remaining buffer size in _IO_wdo_write (bug 31183) 2024-01-02 14:36:17 +01:00
locale Define ISO 639-3 "ssy" (Saho) 2024-01-18 11:01:10 +01:00
localedata localedata: Use consistent values for grouping and mon_grouping 2024-01-25 11:41:02 +01:00
login Update copyright dates not handled by scripts/update-copyrights 2024-01-01 10:53:40 -08:00
mach mach: Drop some unnecessary vm_param.h includes 2024-01-03 21:59:54 +01:00
malloc Make __getrandom_nocancel set errno and add a _nostatus version 2024-01-12 14:23:11 +01:00
manual manual: fix order of arguments of memalign and aligned_alloc (Bug 27547) 2024-01-24 12:10:38 -05:00
math math: remove exp10 wrappers 2024-01-12 16:02:12 +00:00
mathvec Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
misc syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246) 2024-01-30 15:53:37 +01:00
nis Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
nptl Remove ia64-linux-gnu 2024-01-08 17:09:36 -03:00
nptl_db Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
nscd Update copyright dates not handled by scripts/update-copyrights 2024-01-01 10:53:40 -08:00
nss getaddrinfo: translate ENOMEM to EAI_MEMORY (bug 31163) 2024-01-02 11:10:42 +01:00
po po: Incorporate translations (sr) 2024-01-23 22:28:23 +01:00
posix Omit regex.c pragmas no longer needed 2024-01-01 10:53:40 -08:00
resolv Relicense IBM portions of resolv/base64.c resolv/res_debug.c. 2024-01-26 13:33:36 -05:00
resource Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
rt Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
scripts Use binutils 2.42 branch in build-many-glibcs.py 2024-01-30 14:20:35 +00:00
setjmp Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
signal Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
socket Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
soft-fp Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
stdio-common localedata: Use consistent values for grouping and mon_grouping 2024-01-25 11:41:02 +01:00
stdlib qsort: Fix a typo causing unnecessary malloc/free (BZ 31276) 2024-01-23 05:17:31 -08:00
string string: Disable stack protector for memset in early static initialization 2024-01-23 10:22:59 -03:00
sunrpc Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
support Remove ia64-linux-gnu 2024-01-08 17:09:36 -03:00
sysdeps riscv: add support for static PIE 2024-01-22 14:58:23 +01:00
sysvipc Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
termios Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
time Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
timezone Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
wcsmbs Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
wctype Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
.clang-format Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
.gitattributes Assume __NR_openat is always defined 2016-03-23 23:35:08 +01:00
.gitignore Add *.pyc to .gitignore 2015-05-18 15:26:26 +05:30
abi-tags Remove the bulk of the NaCl port. 2017-05-20 08:09:10 -04:00
aclocal.m4 configure: Use autoconf 2.71 2023-07-17 10:08:10 -04:00
config.h.in LoongArch: Add minuimum binutils required version 2023-08-14 09:47:09 +08:00
config.make.in crypt: Remove libcrypt support 2023-10-30 13:03:59 -03:00
configure Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
configure.ac crypt: Remove libcrypt support 2023-10-30 13:03:59 -03:00
CONTRIBUTED-BY crypt: Remove libcrypt support 2023-10-30 13:03:59 -03:00
COPYING Update to latest versions of GPL-2.0 and LGPL-2.1 2013-09-09 12:52:48 +10:00
COPYING.LIB Update to latest versions of GPL-2.0 and LGPL-2.1 2013-09-09 12:52:48 +10:00
extra-lib.mk Rename cppflags-iterator.mk to libof-iterator.mk, remove extra-modules.mk. 2017-05-09 07:06:29 -04:00
gen-locales.mk Improve gen-locales.mk and gen-locale.sh to make test files with @ options work 2018-02-27 17:01:57 +01:00
INSTALL i386: Fail if configured with --enable-cet 2024-01-09 13:55:51 -03:00
libc-abis riscv: support GNU indirect function 2021-01-10 21:25:13 -05:00
libof-iterator.mk Rename cppflags-iterator.mk to libof-iterator.mk, remove extra-modules.mk. 2017-05-09 07:06:29 -04:00
LICENSES Relicense IBM portions of resolv/base64.c resolv/res_debug.c. 2024-01-26 13:33:36 -05:00
MAINTAINERS Add MAINTAINERS 2017-05-11 13:38:30 -04:00
Makeconfig Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
Makefile Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
Makefile.help Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
Makefile.in New make target to only build benchmark binaries 2016-04-20 10:23:28 +05:30
Makerules Remove installed header rule on $(..)include/%.h 2024-01-09 10:35:37 -08:00
NEWS manual, NEWS: Document malloc side effect of dynamic TLS changes 2024-01-24 09:34:15 +01:00
o-iterator.mk Fri Mar 17 12:58:37 1995 Roland McGrath <roland@churchy.gnu.ai.mit.edu> 1995-03-17 18:42:51 +00:00
README Remove ia64-linux-gnu 2024-01-08 17:09:36 -03:00
Rules Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
SECURITY.md Adapt the security policy for the security page 2023-12-05 09:15:10 -05:00
SHARED-FILES crypt: Remove libcrypt support 2023-10-30 13:03:59 -03:00
shlib-versions crypt: Remove libcrypt support 2023-10-30 13:03:59 -03:00
test-skeleton.c Update copyright dates with scripts/update-copyrights 2024-01-01 10:53:40 -08:00
version.h Open master branch for glibc 2.39 development 2023-07-31 20:07:55 +02:00

This directory contains the sources of the GNU C Library.
See the file "version.h" for what release version you have.

The GNU C Library is the standard system C library for all GNU systems,
and is an important part of what makes up a GNU system.  It provides the
system API for all programs written in C and C-compatible languages such
as C++ and Objective C; the runtime facilities of other programming
languages use the C library to access the underlying operating system.

In GNU/Linux systems, the C library works with the Linux kernel to
implement the operating system behavior seen by user applications.
In GNU/Hurd systems, it works with a microkernel and Hurd servers.

The GNU C Library implements much of the POSIX.1 functionality in the
GNU/Hurd system, using configurations i[4567]86-*-gnu and x86_64-gnu.

When working with Linux kernels, this version of the GNU C Library
requires Linux kernel version 3.2 or later.

Also note that the shared version of the libgcc_s library must be
installed for the pthread library to work correctly.

The GNU C Library supports these configurations for using Linux kernels:

	aarch64*-*-linux-gnu
	alpha*-*-linux-gnu
	arc*-*-linux-gnu
	arm-*-linux-gnueabi
	csky-*-linux-gnuabiv2
	hppa-*-linux-gnu
	i[4567]86-*-linux-gnu
	x86_64-*-linux-gnu	Can build either x86_64 or x32
	loongarch64-*-linux-gnu Hardware floating point, LE only.
	m68k-*-linux-gnu
	microblaze*-*-linux-gnu
	mips-*-linux-gnu
	mips64-*-linux-gnu
	or1k-*-linux-gnu
	powerpc-*-linux-gnu	Hardware or software floating point, BE only.
	powerpc64*-*-linux-gnu	Big-endian and little-endian.
	s390-*-linux-gnu
	s390x-*-linux-gnu
	riscv32-*-linux-gnu
	riscv64-*-linux-gnu
	sh[34]-*-linux-gnu
	sparc*-*-linux-gnu
	sparc64*-*-linux-gnu

If you are interested in doing a port, please contact the glibc
maintainers; see https://www.gnu.org/software/libc/ for more
information.

See the file INSTALL to find out how to configure, build, and install
the GNU C Library.  You might also consider reading the WWW pages for
the C library at https://www.gnu.org/software/libc/.

The GNU C Library is (almost) completely documented by the Texinfo manual
found in the `manual/' subdirectory.  The manual is still being updated
and contains some known errors and omissions; we regret that we do not
have the resources to work on the manual as much as we would like.  For
corrections to the manual, please file a bug in the `manual' component,
following the bug-reporting instructions below.  Please be sure to check
the manual in the current development sources to see if your problem has
already been corrected.

Please see https://www.gnu.org/software/libc/bugs.html for bug reporting
information.  We are now using the Bugzilla system to track all bug reports.
This web page gives detailed information on how to report bugs properly.

The GNU C Library is free software.  See the file COPYING.LIB for copying
conditions, and LICENSES for notices about a few contributions that require
these additional notices to be distributed.  License copyright years may be
listed using range notation, e.g., 1996-2015, indicating that every year in
the range, inclusive, is a copyrightable year that would otherwise be listed
individually.