diff options
| author | Florian Weimer <fweimer@redhat.com> | 2025-01-22 17:22:02 +0100 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2025-01-22 18:31:24 +0100 |
| commit | 8b5d4be762419c4f6176261c6fea40ac559b88dc (patch) | |
| tree | bceeb6f18e5dde39843192456b8b0279b392f26c /stdlib/groupingwc.c | |
| parent | 525e5f13de043a1eae59e2184afeed2d72c6de48 (diff) | |
| download | glibc-8b5d4be762419c4f6176261c6fea40ac559b88dc.zip glibc-8b5d4be762419c4f6176261c6fea40ac559b88dc.tar.gz glibc-8b5d4be762419c4f6176261c6fea40ac559b88dc.tar.bz2 | |
Fix underallocation of abort_msg_s struct (CVE-2025-0395)
Include the space needed to store the length of the message itself, in
addition to the message string. This resolves BZ #32582.
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
Reviewed: Adhemerval Zanella <adhemerval.zanella@linaro.org>
(cherry picked from commit 68ee0f704cb81e9ad0a78c644a83e1e9cd2ee578)
Conflict in sysdeps/posix/libc_fatal.c due to missing cleanup after
backtrace removal.
Diffstat (limited to 'stdlib/groupingwc.c')
0 files changed, 0 insertions, 0 deletions