From 5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06 Mon Sep 17 00:00:00 2001 From: Paul Pluzhnikov Date: Fri, 6 Feb 2015 00:30:42 -0500 Subject: CVE-2015-1472: wscanf allocates too little memory BZ #16618 Under certain conditions wscanf can allocate too little memory for the to-be-scanned arguments and overflow the allocated buffer. The implementation now correctly computes the required buffer size when using malloc. A regression test was added to tst-sscanf. --- stdio-common/tst-sscanf.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) (limited to 'stdio-common/tst-sscanf.c') diff --git a/stdio-common/tst-sscanf.c b/stdio-common/tst-sscanf.c index aece3f2..8a2eb9e 100644 --- a/stdio-common/tst-sscanf.c +++ b/stdio-common/tst-sscanf.c @@ -233,5 +233,38 @@ main (void) } } + /* BZ #16618 + The test will segfault during SSCANF if the buffer overflow + is not fixed. The size of `s` is such that it forces the use + of malloc internally and this triggers the incorrect computation. + Thus the value for SIZE is arbitrariy high enough that malloc + is used. */ + { +#define SIZE 131072 + CHAR *s = malloc ((SIZE + 1) * sizeof (*s)); + if (s == NULL) + abort (); + for (size_t i = 0; i < SIZE; i++) + s[i] = L('0'); + s[SIZE] = L('\0'); + int i = 42; + /* Scan multi-digit zero into `i`. */ + if (SSCANF (s, L("%d"), &i) != 1) + { + printf ("FAIL: bug16618: SSCANF did not read one input item.\n"); + result = 1; + } + if (i != 0) + { + printf ("FAIL: bug16618: Value of `i` was not zero as expected.\n"); + result = 1; + } + free (s); + if (result != 1) + printf ("PASS: bug16618: Did not crash.\n"); +#undef SIZE + } + + return result; } -- cgit v1.1