diff options
| author | Paul Pluzhnikov <ppluzhnikov@google.com> | 2015-02-24 08:05:34 -0800 |
|---|---|---|
| committer | Paul Pluzhnikov <ppluzhnikov@google.com> | 2015-02-24 08:05:34 -0800 |
| commit | 6909d2767580b680138a6aa49aabf4976770e9f6 (patch) | |
| tree | 7f2b0beb70e3a2119193bbc12672bf8d19b79869 /libio/fileops.c | |
| parent | 65f6f938cd562a614a68e15d0581a34b177ec29d (diff) | |
| download | glibc-6909d2767580b680138a6aa49aabf4976770e9f6.zip glibc-6909d2767580b680138a6aa49aabf4976770e9f6.tar.gz glibc-6909d2767580b680138a6aa49aabf4976770e9f6.tar.bz2 | |
Fix BZ #17916 - fopen unbounded stack usage for ccs= modes
Diffstat (limited to 'libio/fileops.c')
| -rw-r--r-- | libio/fileops.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/libio/fileops.c b/libio/fileops.c index 297b478..2427320 100644 --- a/libio/fileops.c +++ b/libio/fileops.c @@ -353,7 +353,15 @@ _IO_new_file_fopen (_IO_FILE *fp, const char *filename, const char *mode, struct gconv_fcts fcts; struct _IO_codecvt *cc; char *endp = __strchrnul (cs + 5, ','); - char ccs[endp - (cs + 5) + 3]; + char *ccs = malloc (endp - (cs + 5) + 3); + + if (ccs == NULL) + { + int malloc_err = errno; /* Whatever malloc failed with. */ + (void) _IO_file_close_it (fp); + __set_errno (malloc_err); + return NULL; + } *((char *) __mempcpy (ccs, cs + 5, endp - (cs + 5))) = '\0'; strip (ccs, ccs); @@ -365,10 +373,13 @@ _IO_new_file_fopen (_IO_FILE *fp, const char *filename, const char *mode, This means we cannot proceed since the user explicitly asked for these. */ (void) _IO_file_close_it (fp); + free (ccs); __set_errno (EINVAL); return NULL; } + free (ccs); + assert (fcts.towc_nsteps == 1); assert (fcts.tomb_nsteps == 1); |