Re: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

[christos () zoulas com (Christos Zoulas)]

On Mar 27,  2:09pm, cxib () securityreason com (cxib () securityreason com) wrote:
-- Subject: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

[... stuff deleted ...]

| Problem exist also in printf() function.
| 
| Example code will show Integer Overflow .
| 
| - ---example-start--
| #include <stdio.h>
| 
| int
| main(int argc, char *argv[])
| {
| printf("%1410065408.1410065407f\n", 2);
| return 0;
| }
| - ---example-end--
| 
| cxib# gcc -o pln pln.c && ./pln
| Segmentation fault (core dumped)
| 
| What is wrong? the same problem that was in strfmon() function.

This is not the same problem, as I pointed out when I found it
after I fixed the integer overflow in strfmon(3). This is a NULL
pointer dereference caused by an unchecked memory allocation failure
in the gdtoa code. You don't even need to compile any code to cause
it:

$ printf %9999999999.999999999g 2

christos