1 |
From 31106a073882656a2a5ab56c4ce2847e9a334c3c Mon Sep 17 00:00:00 2001 |
2 |
From: Daniel Stenberg <daniel@haxx.se> |
3 |
Date: Wed, 28 Sep 2016 10:15:34 +0200 |
4 |
Subject: [PATCH] aprintf: detect wrap-around when growing allocation |
5 |
|
6 |
On 32bit systems we could otherwise wrap around after 2GB and allocate 0 |
7 |
bytes and crash. |
8 |
|
9 |
CVE-2016-8618 |
10 |
|
11 |
Bug: https://curl.haxx.se/docs/adv_20161102D.html |
12 |
Reported-by: Cure53 |
13 |
--- |
14 |
lib/mprintf.c | 9 ++++++--- |
15 |
1 file changed, 6 insertions(+), 3 deletions(-) |
16 |
|
17 |
diff --git a/lib/mprintf.c b/lib/mprintf.c |
18 |
index dbedeaa..2c88aa8 100644 |
19 |
--- a/lib/mprintf.c |
20 |
+++ b/lib/mprintf.c |
21 |
@@ -1034,20 +1034,23 @@ static int alloc_addbyter(int output, FILE *data) |
22 |
} |
23 |
infop->alloc = 32; |
24 |
infop->len =0; |
25 |
} |
26 |
else if(infop->len+1 >= infop->alloc) { |
27 |
- char *newptr; |
28 |
+ char *newptr = NULL; |
29 |
+ size_t newsize = infop->alloc*2; |
30 |
|
31 |
- newptr = realloc(infop->buffer, infop->alloc*2); |
32 |
+ /* detect wrap-around or other overflow problems */ |
33 |
+ if(newsize > infop->alloc) |
34 |
+ newptr = realloc(infop->buffer, newsize); |
35 |
|
36 |
if(!newptr) { |
37 |
infop->fail = 1; |
38 |
return -1; /* fail */ |
39 |
} |
40 |
infop->buffer = newptr; |
41 |
- infop->alloc *= 2; |
42 |
+ infop->alloc = newsize; |
43 |
} |
44 |
|
45 |
infop->buffer[ infop->len ] = outc; |
46 |
|
47 |
infop->len++; |
48 |
-- |
49 |
2.9.3 |
50 |
|