Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 21 Dec 2012 16:19:31 -0800
From: Seth Arnold <>
Subject: CVE Request: grep

Hello Kurt, Steve, all.

Paul, I've included you on Cc: to help determine if several grep patches
are security-relevant.

A bug reporter [1] that claims he has, or can produce, a code execution
exploit against grep < 2.11. I've verified that our grep 2.10 package
segfaults on the amd64 platform with the simple reproducer:

$ perl -e 'print "x"x(2**31)' | grep x > /dev/null
Segmentation fault (core dumped)

This specific problem was patched [2] with the following checkin:

This checkin adds this text to the NEWS file:

+ grep no longer dumps core on lines whose lengths do not fit in 'int'.
+ (e.g., lines longer than 2 GiB on a typical 64-bit host).
+ Instead, grep either works as expected, or reports an error.
+ An error can occur if not enough main memory is available, or if the
+ GNU C library's regular expression functions cannot handle such long lines.
+ [bug present since "the beginning"]

Please assign a CVE number for this problem.

Several other checkins around the 2.11 timeframe also look like they
may be security-relevant:

PCRE over-long line fix:

Integer overflow issues:

Paul, are any security issues fixed with those patches? Did I overlook
any other patches that need CVE numbers?



Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.