equal
deleted
inserted
replaced
|
1 From 31106a073882656a2a5ab56c4ce2847e9a334c3c Mon Sep 17 00:00:00 2001 |
|
2 From: Daniel Stenberg <[email protected]> |
|
3 Date: Wed, 28 Sep 2016 10:15:34 +0200 |
|
4 Subject: [PATCH] aprintf: detect wrap-around when growing allocation |
|
5 |
|
6 On 32bit systems we could otherwise wrap around after 2GB and allocate 0 |
|
7 bytes and crash. |
|
8 |
|
9 CVE-2016-8618 |
|
10 |
|
11 Bug: https://curl.haxx.se/docs/adv_20161102D.html |
|
12 Reported-by: Cure53 |
|
13 --- |
|
14 lib/mprintf.c | 9 ++++++--- |
|
15 1 file changed, 6 insertions(+), 3 deletions(-) |
|
16 |
|
17 --- lib/mprintf.c |
|
18 +++ lib/mprintf.c |
|
19 @@ -1034,20 +1034,23 @@ static int alloc_addbyter(int output, FILE *data) |
|
20 } |
|
21 infop->alloc = 32; |
|
22 infop->len =0; |
|
23 } |
|
24 else if(infop->len+1 >= infop->alloc) { |
|
25 - char *newptr; |
|
26 + char *newptr = NULL; |
|
27 + size_t newsize = infop->alloc*2; |
|
28 |
|
29 - newptr = realloc(infop->buffer, infop->alloc*2); |
|
30 + /* detect wrap-around or other overflow problems */ |
|
31 + if(newsize > infop->alloc) |
|
32 + newptr = realloc(infop->buffer, newsize); |
|
33 |
|
34 if(!newptr) { |
|
35 infop->fail = 1; |
|
36 return -1; /* fail */ |
|
37 } |
|
38 infop->buffer = newptr; |
|
39 - infop->alloc *= 2; |
|
40 + infop->alloc = newsize; |
|
41 } |
|
42 |
|
43 infop->buffer[ infop->len ] = outc; |
|
44 |
|
45 infop->len++; |
|
46 -- |
|
47 2.9.3 |
|
48 |