On Mar 27, 2:09pm, cxib (at) securityreason (dot) com [email concealed] (cxib (at) securityreason (dot) com [email concealed]) wrote:
-- Subject: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

[... stuff deleted ...]

| Problem exist also in printf() function.
|
| Example code will show Integer Overflow .
|
| - ---example-start--
| #include <stdio.h>
|
| int
| main(int argc, char *argv[])
| {
| printf("%1410065408.1410065407f\n", 2);
| return 0;
| }
| - ---example-end--
|
| cxib# gcc -o pln pln.c && ./pln
| Segmentation fault (core dumped)
|
| What is wrong? the same problem that was in strfmon() function.

This is not the same problem, as I pointed out when I found it
after I fixed the integer overflow in strfmon(3). This is a NULL
pointer dereference caused by an unchecked memory allocation failure
in the gdtoa code. You don't even need to compile any code to cause
it:

$ printf %9999999999.999999999g 2

christos

[ reply ]