bugtraq - Re: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20080327174908.E585656539@rebar.astron.com>
Date: Thu, 27 Mar 2008 13:49:08 -0400
From: christos@...las.com (Christos Zoulas)
To: cxib@...urityreason.com, bugtraq@...urityfocus.com
Subject: Re: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

On Mar 27,  2:09pm, cxib@...urityreason.com (cxib@...urityreason.com) wrote:
-- Subject: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities

[... stuff deleted ...]

| Problem exist also in printf() function.
| 
| Example code will show Integer Overflow .
| 
| - ---example-start--
| #include <stdio.h>
| 
| int
| main(int argc, char *argv[])
| {
| printf("%1410065408.1410065407f\n", 2);
| return 0;
| }
| - ---example-end--
| 
| cxib# gcc -o pln pln.c && ./pln
| Segmentation fault (core dumped)
| 
| What is wrong? the same problem that was in strfmon() function.

This is not the same problem, as I pointed out when I found it
after I fixed the integer overflow in strfmon(3). This is a NULL
pointer dereference caused by an unchecked memory allocation failure
in the gdtoa code. You don't even need to compile any code to cause
it:

$ printf %9999999999.999999999g 2

christos