From 4e8a6346cd3da2d88bbad745a1769260d36f2783 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Fri, 1 Jun 2018 10:41:03 +0200 Subject: libio: Avoid _allocate_buffer, _free_buffer function pointers [BZ #23236] These unmangled function pointers reside on the heap and could be targeted by exploit writers, effectively bypassing libio vtable validation. Instead, we ignore these pointers and always call malloc or free. In theory, this is a backwards-incompatible change, but using the global heap instead of the user-supplied callback functions should have little application impact. (The old libstdc++ implementation exposed this functionality via a public, undocumented constructor in its strstreambuf class.) --- ChangeLog | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'ChangeLog') diff --git a/ChangeLog b/ChangeLog index 74588dac11..1b5b27ce4b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,27 @@ +2018-06-01 Florian Weimer + + [BZ #23236] + * libio/strfile.h (struct _IO_str_fields): Rename members to + discourage their use and add comment. + (_IO_STR_DYNAMIC): Remove unused macro. + * libio/strops.c (_IO_str_init_static_internal): Do not use + callback pointers. Call malloc and free. + (_IO_str_overflow): Do not use callback pointers. Call malloc + and free. + (enlarge_userbuf): Likewise. + (_IO_str_finish): Call free. + * libio/wstrops.c (_IO_wstr_init_static): Initialize + _allocate_buffer_unused. + (_IO_wstr_overflow): Do not use callback pointers. Call malloc + and free. + (enlarge_userbuf): Likewise. + (_IO_wstr_finish): Call free. + * debug/vasprintf_chk.c (__vasprintf_chk): Initialize + _allocate_buffer_unused, _free_buffer_unused. + * libio/memstream.c (__open_memstream): Likewise. + * libio/vasprintf.c (_IO_vasprintf): Likewise. + * libio/wmemstream.c (open_wmemstream): Likewise. + 2018-05-30 Paul Pluzhnikov * sysdeps/x86_64/fpu/libm-test-ulps (log_vlen8_avx2): Update for -- cgit v1.2.3