Re: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

On Mar 27, 2:09pm, [email protected] ([email protected]) wrote:
– Subject: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

[… stuff deleted …]

| Problem exist also in printf() function.
|
| Example code will show Integer Overflow .
|
| - —example-start–
| #include <stdio.h>
|
| int
| main(int argc, char *argv[])
| {
| printf("%1410065408.1410065407f\n", 2);
| return 0;
| }
| - —example-end–
|
| cxib# gcc -o pln pln.c && ./pln
| Segmentation fault (core dumped)
|
| What is wrong? the same problem that was in strfmon() function.

This is not the same problem, as I pointed out when I found it
after I fixed the integer overflow in strfmon(3). This is a NULL
pointer dereference caused by an unchecked memory allocation failure
in the gdtoa code. You don't even need to compile any code to cause
it:

$ printf %9999999999.999999999g 2

christos