FreeBSD Bugzilla – Attachment 38204 Details for
Bug 60533
4.9-STABLE libc locale support might contain buffer overflows (or stack corruption, or double free() problem), appearing on some configurations; fix and testcase attached
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
file.diff
file.diff (text/plain), 4.76 KB, created by
dotz
on 2003-12-24 01:30:10 UTC
(
hide
)
Description:
file.diff
Filename:
MIME Type:
Creator:
dotz
Created:
2003-12-24 01:30:10 UTC
Size:
4.76 KB
patch
obsolete
>diff -ur src/lib/libc/stdtime.orig/timelocal.c src/lib/libc/stdtime/timelocal.c >--- src/lib/libc/stdtime.orig/timelocal.c Wed Dec 24 00:42:32 2003 >+++ src/lib/libc/stdtime/timelocal.c Wed Dec 24 00:42:53 2003 >@@ -35,7 +35,7 @@ > > static struct lc_time_T _time_locale; > static int _time_using_locale; >-static char *time_locale_buf; >+static char *time_locale_buf = NULL; > > #define LCTIME_SIZE (sizeof(struct lc_time_T) / sizeof(char *)) > >@@ -111,7 +111,7 @@ > __time_load_locale(const char *name) > { > return (__part_load_locale(name, &_time_using_locale, >- time_locale_buf, "LC_TIME", >+ &time_locale_buf, "LC_TIME", > LCTIME_SIZE, LCTIME_SIZE, > (const char **)&_time_locale)); > } >diff -ur src/lib/libc/locale.orig/ldpart.c src/lib/libc/locale/ldpart.c >--- src/lib/libc/locale.orig/ldpart.c Tue Dec 23 23:53:32 2003 >+++ src/lib/libc/locale/ldpart.c Wed Dec 24 00:29:58 2003 >@@ -66,9 +66,15 @@ > /* > * If the locale name is the same as our cache, use the cache. > */ >- if (*locale_buf != NULL && strcmp(name, *locale_buf) == 0) { >- *using_locale = 1; >- return (_LDP_CACHE); >+ if (locale_buf != NULL) { >+ if (*locale_buf != NULL) { >+ if (strcmp(name, locale_buf) == 0) { >+ *using_locale = 1; >+ return (_LDP_CACHE); >+ } >+ >+ } >+ > } > > /* >@@ -121,8 +127,12 @@ > /* > * Record the successful parse in the cache. > */ >- if (*locale_buf != NULL) >- free(*locale_buf); >+ if (locale_buf != NULL) { >+ if (*locale_buf != NULL) { >+ free(*locale_buf); >+ *locale_buf = NULL; >+ } >+ } > *locale_buf = lbuf; > for (p = *locale_buf, i = 0; i < num_lines; i++) > dst_localebuf[i] = (p += strlen(p) + 1); >diff -ur src/lib/libc/locale.orig/lmessages.c src/lib/libc/locale/lmessages.c >--- src/lib/libc/locale.orig/lmessages.c Tue Dec 23 23:53:32 2003 >+++ src/lib/libc/locale/lmessages.c Tue Dec 23 23:56:30 2003 >@@ -28,7 +28,7 @@ > __FBSDID("$FreeBSD: src/lib/libc/locale/lmessages.c,v 1.9.2.2 2002/08/12 11:17:37 ache Exp $"); > > #include <stddef.h> >- >+#include <stdlib.h> > #include "lmessages.h" > #include "ldpart.h" > >@@ -47,7 +47,7 @@ > > static struct lc_messages_T _messages_locale; > static int _messages_using_locale; >-static char *_messages_locale_buf; >+static char *_messages_locale_buf = NULL; > > int > __messages_load_locale(const char *name) >@@ -55,7 +55,7 @@ > int ret; > > ret = __part_load_locale(name, &_messages_using_locale, >- _messages_locale_buf, "LC_MESSAGES", >+ &_messages_locale_buf, "LC_MESSAGES", > LCMESSAGES_SIZE_FULL, LCMESSAGES_SIZE_MIN, > (const char **)&_messages_locale); > if (ret == _LDP_LOADED) { >diff -ur src/lib/libc/locale.orig/lmonetary.c src/lib/libc/locale/lmonetary.c >--- src/lib/libc/locale.orig/lmonetary.c Tue Dec 23 23:53:32 2003 >+++ src/lib/libc/locale/lmonetary.c Wed Dec 24 00:10:09 2003 >@@ -60,7 +60,7 @@ > > static struct lc_monetary_T _monetary_locale; > static int _monetary_using_locale; >-static char *_monetary_locale_buf; >+static char *_monetary_locale_buf = NULL; > > static char > cnv(const char *str) >@@ -78,7 +78,7 @@ > int ret; > > ret = __part_load_locale(name, &_monetary_using_locale, >- _monetary_locale_buf, "LC_MONETARY", >+ &_monetary_locale_buf, "LC_MONETARY", > LCMONETARY_SIZE, LCMONETARY_SIZE, > (const char **)&_monetary_locale); > if (ret != _LDP_ERROR) >diff -ur src/lib/libc/locale.orig/lnumeric.c src/lib/libc/locale/lnumeric.c >--- src/lib/libc/locale.orig/lnumeric.c Tue Dec 23 23:53:32 2003 >+++ src/lib/libc/locale/lnumeric.c Tue Dec 23 23:56:21 2003 >@@ -28,6 +28,7 @@ > __FBSDID("$FreeBSD: src/lib/libc/locale/lnumeric.c,v 1.10.2.2 2002/08/12 11:17:38 ache Exp $"); > > #include <limits.h> >+#include <stdlib.h> > #include "lnumeric.h" > #include "ldpart.h" > >@@ -46,7 +47,7 @@ > > static struct lc_numeric_T _numeric_locale; > static int _numeric_using_locale; >-static char *_numeric_locale_buf; >+static char *_numeric_locale_buf = NULL; > > int > __numeric_load_locale(const char *name) >@@ -54,7 +55,7 @@ > int ret; > > ret = __part_load_locale(name, &_numeric_using_locale, >- _numeric_locale_buf, "LC_NUMERIC", >+ &_numeric_locale_buf, "LC_NUMERIC", > LCNUMERIC_SIZE, LCNUMERIC_SIZE, > (const char **)&_numeric_locale); > if (ret != _LDP_ERROR)
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 60533
: 38204