diff options
author | Peter Ammon <corydoras@ridiculousfish.com> | 2024-09-08 20:34:12 -0700 |
---|---|---|
committer | Adhemerval Zanella <adhemerval.zanella@linaro.org> | 2024-10-25 15:05:06 -0300 |
commit | 18596c5415e1415285b28120b70ee82792509ea2 (patch) | |
tree | 6f120a27c7b02ddd6f22a21a3e68c52a9f5f5b96 /sysdeps/unix/sysv/linux/system.c | |
parent | 04e8698fcca7d1e932bc54f5b60e1bbce2e87601 (diff) | |
download | glibc-18596c5415e1415285b28120b70ee82792509ea2.tar.gz glibc-18596c5415e1415285b28120b70ee82792509ea2.tar.xz glibc-18596c5415e1415285b28120b70ee82792509ea2.zip |
libio: Fix crash in fputws [BZ #20632]
This fixes a buffer overflow in wide character string output, reproducing when output fails, such as if the output fd is closed or is redirected to a full device. Wide character output data attempts to maintain the invariant that `_IO_buf_base <= _IO_write_base <= _IO_write_end <= _IO_buf_end` (that is, that the write region is a sub-region of `_IO_buf`). Prior to this commit, this invariant is violated by the `_IO_wfile_overflow` function as so: 1. `_IO_wsetg` is called, assigning `_IO_write_base` to `_IO_buf_base` 2. `_IO_doallocbuf` is called, which jumps to `_IO_wfile_doallocate` via the _IO_wfile_jumps vtable. This function then assigns the wide data `_IO_buf_base` and `_IO_buf_end` to a malloc'd buffer. Thus the invariant is violated. The fix is simply to reverse the order: malloc the `_IO_buf` first and then assign `_IO_write_base` to it. We also take this opportunity to defensively guard the initialization of the number of unwritten characters via pointer arithmetic. We now check that the buffer end is not before the buffer beginning; this matches a similar defensive check in the narrow analogue `fileops.c`. Add a test which fails without the fix. Signed-off-by: Peter Ammon <corydoras@ridiculousfish.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Diffstat (limited to 'sysdeps/unix/sysv/linux/system.c')
0 files changed, 0 insertions, 0 deletions