mirror of git://sourceware.org/git/glibc.git
6caddd34bd
The vfprintf implementation (used for all printf-family functions)
contains complicated logic to allocate internal buffers of a size
depending on the width and precision used for a format, using either
malloc or alloca depending on that size, and with consequent checks
for size overflow and allocation failure.
As noted in bug 26211, the version of that logic used when '$' plus
argument number formats are in use is missing the overflow checks,
which can result in segfaults (quite possibly exploitable, I didn't
try to work that out) when the width or precision is in the range
0x7fffffe0 through 0x7fffffff (maybe smaller values as well in the
wprintf case on 32-bit systems, when the multiplication by sizeof
(CHAR_T) can overflow).
All that complicated logic in fact appears to be useless. As far as I
can tell, there has been no need (outside the floating-point printf
code, which does its own allocations) for allocations depending on
width or precision since commit
|
||
|---|---|---|
| .. | ||
| bits | ||
| Depend | ||
| Makefile | ||
| Versions | ||
| _i18n_number.h | ||
| _itoa.c | ||
| _itowa.c | ||
| _itowa.h | ||
| asprintf.c | ||
| bug-vfprintf-nargs.c | ||
| bug1.c | ||
| bug1.input | ||
| bug2.c | ||
| bug3.c | ||
| bug4.c | ||
| bug5.c | ||
| bug6.c | ||
| bug6.input | ||
| bug7.c | ||
| bug8.c | ||
| bug9.c | ||
| bug10.c | ||
| bug11.c | ||
| bug12.c | ||
| bug13.c | ||
| bug14.c | ||
| bug16.c | ||
| bug17.c | ||
| bug18.c | ||
| bug18a.c | ||
| bug19.c | ||
| bug19a.c | ||
| bug20.c | ||
| bug21.c | ||
| bug22.c | ||
| bug23-2.c | ||
| bug23-3.c | ||
| bug23-4.c | ||
| bug23.c | ||
| bug24.c | ||
| bug25.c | ||
| bug26.c | ||
| ctermid.c | ||
| cuserid.c | ||
| dprintf.c | ||
| errlist.c | ||
| errnobug.c | ||
| flockfile.c | ||
| fprintf.c | ||
| fscanf.c | ||
| ftrylockfile.c | ||
| funlockfile.c | ||
| fxprintf.c | ||
| gentempfd.c | ||
| getline.c | ||
| getw.c | ||
| iovfscanf.c | ||
| iovfwscanf.c | ||
| isoc99_fscanf.c | ||
| isoc99_scanf.c | ||
| isoc99_sscanf.c | ||
| isoc99_vfscanf.c | ||
| isoc99_vscanf.c | ||
| isoc99_vsscanf.c | ||
| itoa-digits.c | ||
| itoa-udigits.c | ||
| itowa-digits.c | ||
| perror.c | ||
| printf-parse.h | ||
| printf-parsemb.c | ||
| printf-parsewc.c | ||
| printf-prs.c | ||
| printf.c | ||
| printf.h | ||
| printf_fp.c | ||
| printf_fphex.c | ||
| printf_size.c | ||
| psiginfo-data.h | ||
| psiginfo-define.h | ||
| psiginfo.c | ||
| psignal.c | ||
| putw.c | ||
| reg-modifier.c | ||
| reg-printf.c | ||
| reg-type.c | ||
| remove.c | ||
| rename.c | ||
| renameat.c | ||
| renameat2.c | ||
| scanf.c | ||
| scanf1.c | ||
| scanf2.c | ||
| scanf3.c | ||
| scanf4.c | ||
| scanf5.c | ||
| scanf7.c | ||
| scanf8.c | ||
| scanf9.c | ||
| scanf10.c | ||
| scanf11.c | ||
| scanf12.c | ||
| scanf12.input | ||
| scanf13.c | ||
| scanf14.c | ||
| scanf14a.c | ||
| scanf15.c | ||
| scanf16.c | ||
| scanf16a.c | ||
| scanf17.c | ||
| siglist.c | ||
| snprintf.c | ||
| sprintf.c | ||
| sscanf.c | ||
| stdio_ext.h | ||
| stdio_lim.h.in | ||
| tempnam.c | ||
| tempname.c | ||
| temptest.c | ||
| test-fseek.c | ||
| test-fwrite.c | ||
| test-popen.c | ||
| test-vfprintf.c | ||
| test_rdwr.c | ||
| tfformat.c | ||
| tiformat.c | ||
| tllformat.c | ||
| tmpfile.c | ||
| tmpfile64.c | ||
| tmpnam.c | ||
| tmpnam_r.c | ||
| tst-bz11319-fortify2.c | ||
| tst-bz11319.c | ||
| tst-cookie.c | ||
| tst-fdopen.c | ||
| tst-ferror.c | ||
| tst-ferror.input | ||
| tst-fgets.c | ||
| tst-fileno.c | ||
| tst-fmemopen.c | ||
| tst-fmemopen2.c | ||
| tst-fmemopen3.c | ||
| tst-fmemopen4.c | ||
| tst-fphex-wide.c | ||
| tst-fphex.c | ||
| tst-fseek.c | ||
| tst-fwrite.c | ||
| tst-gets.c | ||
| tst-gets.input | ||
| tst-grouping.c | ||
| tst-long-dbl-fphex.c | ||
| tst-obprintf.c | ||
| tst-perror.c | ||
| tst-popen.c | ||
| tst-popen2.c | ||
| tst-printf-bz18872.sh | ||
| tst-printf-bz25691.c | ||
| tst-printf-round.c | ||
| tst-printf.c | ||
| tst-printf.sh | ||
| tst-printfsz-islongdouble.c | ||
| tst-printfsz-islongdouble.sh | ||
| tst-printfsz.c | ||
| tst-put-error.c | ||
| tst-renameat2.c | ||
| tst-rndseek.c | ||
| tst-scanf-round.c | ||
| tst-setvbuf1.c | ||
| tst-setvbuf1.expect | ||
| tst-sprintf.c | ||
| tst-sprintf2.c | ||
| tst-sprintf3.c | ||
| tst-sscanf.c | ||
| tst-swprintf.c | ||
| tst-swscanf.c | ||
| tst-tmpnam.c | ||
| tst-unbputc.c | ||
| tst-unbputc.sh | ||
| tst-ungetc.c | ||
| tst-unlockedio.c | ||
| tst-vfprintf-mbs-prec.c | ||
| tst-vfprintf-user-type.c | ||
| tst-vfprintf-width-prec-alloc.c | ||
| tst-vfprintf-width-prec.c | ||
| tst-wc-printf.c | ||
| tstdiomisc.c | ||
| tstgetln.c | ||
| tstgetln.input | ||
| tstscanf.c | ||
| tstscanf.input | ||
| vfprintf-internal.c | ||
| vfprintf.c | ||
| vfscanf-internal.c | ||
| vfscanf.c | ||
| vfwprintf-internal.c | ||
| vfwprintf.c | ||
| vfwscanf-internal.c | ||
| vfwscanf.c | ||
| vprintf.c | ||
| xbug.c | ||