Date: Wed, 29 Aug 2012 20:11:50 +0200 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Subject: CVE-2012-3509: objalloc_alloc integer overflows in libiberty Sang Kil Cha discovered that _objalloc_alloc does not guard the addition of CHUNK_HEADER_SIZE to the length against overflow. This can cause _objalloc_alloc to return a pointer to a memory region which is smaller than expected. The pointer alignment arithmetic in the objalloc_alloc macro misses an overflow check as well, with similar consequences. GCC bug: http://gcc.gnu.org/bugzilla/show_activity.cgi?id=54411 Patch under review: http://gcc.gnu.org/ml/gcc-patches/2012-08/msg01986.html (I believe GCC has the master copy of this file, but does not use it itself. libiberty is part of binutils and GDB, too.)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.