[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 29 Aug 2012 20:11:50 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: CVE-2012-3509: objalloc_alloc integer overflows in libiberty
Sang Kil Cha discovered that _objalloc_alloc does not guard the
addition of CHUNK_HEADER_SIZE to the length against overflow. This
can cause _objalloc_alloc to return a pointer to a memory region which
is smaller than expected.
The pointer alignment arithmetic in the objalloc_alloc macro misses an
overflow check as well, with similar consequences.
GCC bug:
http://gcc.gnu.org/bugzilla/show_activity.cgi?id=54411
Patch under review:
http://gcc.gnu.org/ml/gcc-patches/2012-08/msg01986.html
(I believe GCC has the master copy of this file, but does not use it
itself. libiberty is part of binutils and GDB, too.)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
