musl - Possible out of bounds memory write in initialization of xdigits in src/stdio/vfprintf.c

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANravCDuLFZ8tV56ZKo7BpwiKS59a1nSOyuGL1-a9Pis7ZrhxQ@mail.gmail.com>
Date: Thu, 28 Jun 2018 10:31:55 -0700
From: Mark Winterrowd <markwinterrowd4@...il.com>
To: musl@...ts.openwall.com
Subject: Possible out of bounds memory write in initialization of xdigits in src/stdio/vfprintf.c

Hi all,

On line 148 of src/stdio/vfprintf.c in the source tree head, you can
observe the following global initialization:

static const char xdigits[16] = {
"0123456789ABCDEF"
};

Note that while this xdigits array has a length of 16, the string it is
being initialized to has a length of 17, due to the implicit null
terminator. Thus, an additional '\0' will be written just past the end of
this global. I believe this could cause unpredictable effects depending
upon how the compiler and linker handle this situation.

The fix is simple, just write out a list of comma separated characters to
eliminate the null terminator or make xdigits have a length of 17.

Thanks,
Mark Winterrowd

Content of type "text/html" skipped

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.