AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-21 20:40:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
6caddd34bd
glibc/stdio-common
History
Joseph Myers 6caddd34bd Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211). 
The vfprintf implementation (used for all printf-family functions)
contains complicated logic to allocate internal buffers of a size
depending on the width and precision used for a format, using either
malloc or alloca depending on that size, and with consequent checks
for size overflow and allocation failure.

As noted in bug 26211, the version of that logic used when '$' plus
argument number formats are in use is missing the overflow checks,
which can result in segfaults (quite possibly exploitable, I didn't
try to work that out) when the width or precision is in the range
0x7fffffe0 through 0x7fffffff (maybe smaller values as well in the
wprintf case on 32-bit systems, when the multiplication by sizeof
(CHAR_T) can overflow).

All that complicated logic in fact appears to be useless.  As far as I
can tell, there has been no need (outside the floating-point printf
code, which does its own allocations) for allocations depending on
width or precision since commit
3e95f6602b ("Remove limitation on size
of precision for integers", Sun Sep 12 21:23:32 1999 +0000).  Thus,
this patch removes that logic completely, thereby fixing both problems
with excessive allocations for large width and precision for
non-floating-point formats, and the problem with missing overflow
checks with such allocations.  Note that this does have the
consequence that width and precision up to INT_MAX are now allowed
where previously INT_MAX / sizeof (CHAR_T) - EXTSIZ or more would have
been rejected, so could potentially expose any other overflows where
the value would previously have been rejected by those removed checks.

I believe this completely fixes bugs 14231 and 26211.

Excessive allocations are still possible in the floating-point case
(bug 21127), as are other integer or buffer overflows (see bug 26201).
This does not address the cases where a precision larger than INT_MAX
(embedded in the format string) would be meaningful without printf's
return value overflowing (when it's used with a string format, or %g
without the '#' flag, so the actual output will be much smaller), as
mentioned in bug 17829 comment 8; using size_t internally for
precision to handle that case would be complicated by struct
printf_info being a public ABI.  Nor does it address the matter of an
INT_MIN width being negated (bug 17829 comment 7; the same logic
appears a second time in the file as well, in the form of multiplying
by -1).  There may be other sources of memory allocations with malloc
in printf functions as well (bug 24988, bug 16060).  From inspection,
I think there are also integer overflows in two copies of "if ((width
-= len) < 0)" logic (where width is int, len is size_t and a very long
string could result in spurious padding being output on a 32-bit
system before printf overflows the count of output characters).

Tested for x86-64 and x86.
2020-07-07 14:54:12 +00:00
..
bits Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
_i18n_number.h Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
_itoa.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
_itowa.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
_itowa.h Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
asprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
bug1.c
bug1.input
bug2.c
bug3.c Fix hardcoded /tmp paths in testing (bug 13888). 2018-06-26 21:48:48 +00:00
bug4.c Fix hardcoded /tmp paths in testing (bug 13888). 2018-06-26 21:48:48 +00:00
bug5.c Fix hardcoded /tmp paths in testing (bug 13888). 2018-06-26 21:48:48 +00:00
bug6.c
bug6.input
bug7.c Avoid insecure usage of tmpnam in tests. 2018-07-18 21:04:12 +00:00
bug8.c
bug9.c
bug10.c
bug11.c
bug12.c
bug13.c Update. 2000-07-29 06:45:51 +00:00
bug14.c Update. 2003-01-28 07:32:19 +00:00
bug16.c stdio-common: Use array_length and array_end macros 2017-11-02 12:45:20 +01:00
bug17.c [BZ #3902] 2007-01-22 16:18:03 +00:00
bug18.c * libio/wstrops.c (_IO_wstr_underflow): Clear errno before 2007-07-07 21:38:43 +00:00
bug18a.c * libio/wstrops.c (_IO_wstr_underflow): Clear errno before 2007-07-07 21:38:43 +00:00
bug19.c * stdio-common/vfscanf.c (_IO_vfscanf): Add additional test for EOF 2007-07-08 04:41:34 +00:00
bug19a.c * stdio-common/vfscanf.c (_IO_vfscanf): Add additional test for EOF 2007-07-08 04:41:34 +00:00
bug20.c * stdio-common/Makefile (tests): Add bug20. 2007-10-28 16:45:27 +00:00
bug21.c Use C99-compliant scanf under _GNU_SOURCE with modern compilers. 2019-01-03 11:12:39 -05:00
bug22.c Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211). 2020-07-07 14:54:12 +00:00
bug23-2.c CVE-2012-3406: Stack overflow in vfprintf [BZ #16617] 2014-12-15 10:09:33 +01:00
bug23-3.c CVE-2012-3406: Stack overflow in vfprintf [BZ #16617] 2014-12-15 10:09:33 +01:00
bug23-4.c CVE-2012-3406: Stack overflow in vfprintf [BZ #16617] 2014-12-15 10:09:33 +01:00
bug23.c Fix allocation when handling positional parameters in printf. 2011-02-20 07:59:49 -05:00
bug24.c Add test for BZ 13114 2011-08-20 09:22:16 -04:00
bug25.c Another round of inclusion fixes for _ISOMAC testsuite. 2017-03-22 08:44:32 -04:00
bug26.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
bug-vfprintf-nargs.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
ctermid.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
cuserid.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
Depend Update. 2000-07-29 06:45:51 +00:00
dprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
errlist.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
errnobug.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
flockfile.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
fprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
fscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
ftrylockfile.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
funlockfile.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
fxprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
gentempfd.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
getline.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
getw.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
iovfscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
iovfwscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
isoc99_fscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
isoc99_scanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
isoc99_sscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
isoc99_vfscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
isoc99_vscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
isoc99_vsscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
itoa-digits.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
itoa-udigits.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
itowa-digits.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
Makefile Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211). 2020-07-07 14:54:12 +00:00
perror.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
printf_fp.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
printf_fphex.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
printf_size.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
printf-parse.h Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
printf-parsemb.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
printf-parsewc.c Update. 2003-06-11 23:22:36 +00:00
printf-prs.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
printf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
printf.h Rename __LONG_DOUBLE_USES_FLOAT128 to __LDOUBLE_REDIRECTS_TO_FLOAT128_ABI 2020-04-30 08:52:08 -05:00
psiginfo-data.h Fix typos. 2013-10-12 14:47:50 +02:00
psiginfo-define.h * locale/langinfo.h: nl_langinfo_l is in POSIX 2008. 2009-02-26 06:18:24 +00:00
psiginfo.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
psignal.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
putw.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
reg-modifier.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
reg-printf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
reg-type.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
remove.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
rename.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
renameat2.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
renameat.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
scanf1.c
scanf2.c
scanf3.c
scanf4.c Split DIAG_* macros to new header libc-diag.h. 2017-02-25 09:59:46 -05:00
scanf5.c
scanf7.c Split DIAG_* macros to new header libc-diag.h. 2017-02-25 09:59:46 -05:00
scanf8.c
scanf9.c Update. 2000-12-15 16:03:57 +00:00
scanf10.c
scanf11.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
scanf12.c Update. 2000-07-22 07:26:13 +00:00
scanf12.input
scanf13.c Avoid warning in scanf test. 2009-10-30 09:23:24 -07:00
scanf14.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
scanf14a.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
scanf15.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
scanf16.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
scanf16a.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
scanf17.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
scanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
siglist.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
snprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
sprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
sscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
stdio_ext.h Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
stdio_lim.h.in Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tempnam.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tempname.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
temptest.c * malloc/memusagestat.c (main): Use return instead of exit to 2000-12-31 10:52:32 +00:00
test_rdwr.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
test-fseek.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
test-fwrite.c Modify several tests to use test-skeleton.c 2015-08-06 02:59:04 -04:00
test-popen.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
test-vfprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tfformat.c Avoid use of "register" as optimization hint. 2013-06-07 22:24:35 +00:00
tiformat.c
tllformat.c
tmpfile64.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tmpfile.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tmpnam_r.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tmpnam.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-bz11319-fortify2.c Use PRINTF_FORTIFY instead of _IO_FLAGS2_FORTIFY (bug 11319) 2018-12-05 18:15:43 -02:00
tst-bz11319.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-cookie.c Modify several tests to use test-skeleton.c 2014-11-05 15:24:08 +05:30
tst-fdopen.c Avoid insecure usage of tmpnam in tests. 2018-07-18 21:04:12 +00:00
tst-ferror.c Modify several tests to use test-skeleton.c 2015-08-06 02:59:04 -04:00
tst-ferror.input
tst-fgets.c Prefer https for Sourceware links 2017-11-16 11:49:26 +05:30
tst-fileno.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-fmemopen2.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-fmemopen3.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-fmemopen4.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-fmemopen.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-fphex-wide.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-fphex.c stdio-common: Use array_length and array_end macros 2017-11-02 12:45:20 +01:00
tst-fseek.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-fwrite.c Prefer https for Sourceware links 2017-11-16 11:49:26 +05:30
tst-gets.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-gets.input Update. 2001-02-15 19:57:43 +00:00
tst-grouping.c Fix grouping when rounding increases number of integer digits. 2011-01-12 20:37:51 -05:00
tst-long-dbl-fphex.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-obprintf.c Modify several tests to use test-skeleton.c 2014-11-05 15:24:08 +05:30
tst-perror.c Modify several tests to use test-skeleton.c 2014-11-05 15:24:08 +05:30
tst-popen2.c * libio/iopopen.c (_IO_new_proc_open): Don't close child_std_end 2007-07-19 17:03:08 +00:00
tst-popen.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-printf-bz18872.sh Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-printf-bz25691.c stdio: Add tests for printf multibyte convertion leak [BZ#25691] 2020-03-20 11:02:38 -03:00
tst-printf-round.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-printf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-printf.sh Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-printfsz-islongdouble.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-printfsz-islongdouble.sh Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-printfsz.c Split DIAG_* macros to new header libc-diag.h. 2017-02-25 09:59:46 -05:00
tst-put-error.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-renameat2.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-rndseek.c Don't reduce test timeout to less than default 2018-10-17 09:34:13 +02:00
tst-scanf-round.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-setvbuf1.c * stdio-common/Makefile: Add rules to build and run tst-setvbuf1. 2008-07-08 16:32:55 +00:00
tst-setvbuf1.expect * stdio-common/Makefile: Add rules to build and run tst-setvbuf1. 2008-07-08 16:32:55 +00:00
tst-sprintf2.c Modify several tests to use test-skeleton.c 2014-11-05 15:24:08 +05:30
tst-sprintf3.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-sprintf.c Split DIAG_* macros to new header libc-diag.h. 2017-02-25 09:59:46 -05:00
tst-sscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-swprintf.c stdio-common: Use array_length and array_end macros 2017-11-02 12:45:20 +01:00
tst-swscanf.c * stdio-common/Makefile (tests): Add tst-swscanf. 2007-02-18 09:21:24 +00:00
tst-tmpnam.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-unbputc.c Modify several tests to use test-skeleton.c 2014-11-05 15:24:08 +05:30
tst-unbputc.sh Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-ungetc.c Avoid insecure usage of tmpnam in tests. 2018-07-18 21:04:12 +00:00
tst-unlockedio.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-vfprintf-mbs-prec.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-vfprintf-user-type.c Rename __LONG_DOUBLE_USES_FLOAT128 to __LDOUBLE_REDIRECTS_TO_FLOAT128_ABI 2020-04-30 08:52:08 -05:00
tst-vfprintf-width-prec-alloc.c Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211). 2020-07-07 14:54:12 +00:00
tst-vfprintf-width-prec.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tst-wc-printf.c Modify several tests to use test-skeleton.c 2014-11-05 15:24:08 +05:30
tstdiomisc.c stdio-common: Use array_length and array_end macros 2017-11-02 12:45:20 +01:00
tstgetln.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tstgetln.input
tstscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
tstscanf.input
Versions Add __vfscanf_internal and __vfwscanf_internal with flags arguments. 2018-12-05 18:15:42 -02:00
vfprintf-internal.c Remove most vfprintf width/precision-dependent allocations (bug 14231, bug 26211). 2020-07-07 14:54:12 +00:00
vfprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
vfscanf-internal.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
vfscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
vfwprintf-internal.c Add __v*printf_internal with flags arguments 2018-12-05 18:15:42 -02:00
vfwprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
vfwscanf-internal.c Add __vfscanf_internal and __vfwscanf_internal with flags arguments. 2018-12-05 18:15:42 -02:00
vfwscanf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
vprintf.c Update copyright dates with scripts/update-copyrights. 2020-01-01 00:14:33 +00:00
xbug.c Convert 703 function definitions to prototype style. 2015-10-16 20:21:49 +00:00