glibc/glibc-CVE-2012-3405.patch
Danila Leontiev 62d5878cfa Security fix
2013-07-15 11:41:27 +04:00

51 lines
1.5 KiB
Diff

diff --git a/stdio-common/bug23.c b/stdio-common/bug23.c
new file mode 100644
index 0000000..dcc5428
--- /dev/null
+++ b/stdio-common/bug23.c
@@ -0,0 +1,21 @@
+#include <stdio.h>
+#include <string.h>
+
+static char buf[32768];
+static const char expected[] = "\
+\n\
+a\n\
+abbcd55%%%%%%%%%%%%%%%%%%%%%%%%%%\n";
+
+static int
+do_test (void)
+{
+ snprintf (buf, sizeof (buf),
+ "\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d"
+ "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n",
+ "a", "b", "c", "d", 5);
+ return strcmp (buf, expected) != 0;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index fc370e8..cfa4c30 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1991-2008, 2009, 2010 Free Software Foundation, Inc.
+/* Copyright (C) 1991-2008, 2009, 2010, 2011 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
@@ -1682,7 +1682,8 @@ do_positional:
{
/* Extend the array of format specifiers. */
struct printf_spec *old = specs;
- specs = extend_alloca (specs, nspecs_max, 2 * nspecs_max);
+ specs = extend_alloca (specs, nspecs_max,
+ 2 * nspecs_max * sizeof (*specs));
/* Copy the old array's elements to the new space. */
memmove (specs, old, nspecs * sizeof (struct printf_spec));
--
1.7.1