about summary refs log tree commit diff
path: root/NEWS
diff options
context:
space:
mode:
authorSiddhesh Poyarekar <siddhesh@redhat.com>2014-03-27 19:48:15 +0530
committerSiddhesh Poyarekar <siddhesh@redhat.com>2014-03-27 19:48:15 +0530
commitea7d8b95e2fcb81f68b04ed7787a3dbda023991a (patch)
tree20e3018b10da00729cd8a8feec1e2265b173c321 /NEWS
parentdf5b85da90915ce6208ad737807e3d8f2a8fce87 (diff)
downloadglibc-ea7d8b95e2fcb81f68b04ed7787a3dbda023991a.tar.gz
glibc-ea7d8b95e2fcb81f68b04ed7787a3dbda023991a.tar.xz
glibc-ea7d8b95e2fcb81f68b04ed7787a3dbda023991a.zip
Avoid overlapping addresses to stpcpy calls in nscd (BZ #16760)
Calls to stpcpy from nscd netgroups code will have overlapping source
and destination when all three values in the returned triplet are
non-NULL and in the expected (host,user,domain) order.  This is seen
in valgrind as:

==3181== Source and destination overlap in stpcpy(0x19973b48, 0x19973b48)
==3181==    at 0x4C2F30A: stpcpy (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==3181==    by 0x12567A: addgetnetgrentX (string3.h:111)
==3181==    by 0x12722D: addgetnetgrent (netgroupcache.c:665)
==3181==    by 0x11114C: nscd_run_worker (connections.c:1338)
==3181==    by 0x4E3C102: start_thread (pthread_create.c:309)
==3181==    by 0x59B81AC: clone (clone.S:111)
==3181==

Fix this by using memmove instead of stpcpy.
Diffstat (limited to 'NEWS')
-rw-r--r--NEWS2
1 files changed, 1 insertions, 1 deletions
diff --git a/NEWS b/NEWS
index 895c640c5e..6286681b47 100644
--- a/NEWS
+++ b/NEWS
@@ -12,7 +12,7 @@ Version 2.20
   15347, 15804, 15894, 16002, 16198, 16284, 16357, 16447, 16532, 16545,
   16574, 16599, 16600, 16609, 16610, 16611, 16613, 16623, 16632, 16634,
   16639, 16642, 16649, 16670, 16674, 16677, 16680, 16683, 16689, 16695,
-  16701, 16706, 16707, 16712, 16713, 16714, 16731, 16743, 16758.
+  16701, 16706, 16707, 16712, 16713, 16714, 16731, 16743, 16758, 16760.
 
 * Running the testsuite no longer terminates as soon as a test fails.
   Instead, a file tests.sum (xtests.sum from "make xcheck") is generated,