diff options
author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2014-04-25 23:01:48 -0700 |
---|---|---|
committer | Alan Coopersmith <alan.coopersmith@oracle.com> | 2014-05-12 23:31:23 -0700 |
commit | 05c8020a49416dd8b7510cbba45ce4f3fc81a7dc (patch) | |
tree | f1b299a30243a21abaa847d375d1340322977870 /include | |
parent | 2f5e57317339c526e6eaee1010b0e2ab8089c42e (diff) |
CVE-2014-0209: integer overflow of realloc() size in lexAlias()
lexAlias() reads from a file in a loop. It does this by starting with a
64 byte buffer. If that size limit is hit, it does a realloc of the
buffer size << 1, basically doubling the needed length every time the
length limit is hit.
Eventually, this will shift out to 0 (for a length of ~4gig), and that
length will be passed on to realloc(). A length of 0 (with a valid
pointer) causes realloc to free the buffer on most POSIX platforms,
but the caller will still have a pointer to it, leading to use after
free issues.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions