Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
From: Christos Zoulas (christoszoulas.com)
Date: Thu Mar 27 2008 - 12:49:08 CDT
On Mar 27, 2:09pm, cxibsecurityreason.com (cxibsecurityreason.com) wrote:
-- Subject: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities
[... stuff deleted ...]
| Problem exist also in printf() function.
| Example code will show Integer Overflow .
| - ---example-start--
| #include <stdio.h>
| main(int argc, char *argv)
| printf("%1410065408.1410065407f\n", 2);
| return 0;
| - ---example-end--
| cxib# gcc -o pln pln.c && ./pln
| Segmentation fault (core dumped)
| What is wrong? the same problem that was in strfmon() function.
This is not the same problem, as I pointed out when I found it
after I fixed the integer overflow in strfmon(3). This is a NULL
pointer dereference caused by an unchecked memory allocation failure
in the gdtoa code. You don't even need to compile any code to cause
$ printf %9999999999.999999999g 2