aboutsummaryrefslogtreecommitdiff
path: root/libio/fileops.c
diff options
context:
space:
mode:
authorPaul Pluzhnikov <ppluzhnikov@google.com>2015-02-24 08:05:34 -0800
committerPaul Pluzhnikov <ppluzhnikov@google.com>2015-02-24 08:05:34 -0800
commit6909d2767580b680138a6aa49aabf4976770e9f6 (patch)
tree7f2b0beb70e3a2119193bbc12672bf8d19b79869 /libio/fileops.c
parent65f6f938cd562a614a68e15d0581a34b177ec29d (diff)
downloadglibc-6909d2767580b680138a6aa49aabf4976770e9f6.tar
glibc-6909d2767580b680138a6aa49aabf4976770e9f6.tar.gz
glibc-6909d2767580b680138a6aa49aabf4976770e9f6.tar.bz2
glibc-6909d2767580b680138a6aa49aabf4976770e9f6.zip
Fix BZ #17916 - fopen unbounded stack usage for ccs= modes
Diffstat (limited to 'libio/fileops.c')
-rw-r--r--libio/fileops.c13
1 files changed, 12 insertions, 1 deletions
diff --git a/libio/fileops.c b/libio/fileops.c
index 297b4784cc..2427320325 100644
--- a/libio/fileops.c
+++ b/libio/fileops.c
@@ -353,7 +353,15 @@ _IO_new_file_fopen (_IO_FILE *fp, const char *filename, const char *mode,
struct gconv_fcts fcts;
struct _IO_codecvt *cc;
char *endp = __strchrnul (cs + 5, ',');
- char ccs[endp - (cs + 5) + 3];
+ char *ccs = malloc (endp - (cs + 5) + 3);
+
+ if (ccs == NULL)
+ {
+ int malloc_err = errno; /* Whatever malloc failed with. */
+ (void) _IO_file_close_it (fp);
+ __set_errno (malloc_err);
+ return NULL;
+ }
*((char *) __mempcpy (ccs, cs + 5, endp - (cs + 5))) = '\0';
strip (ccs, ccs);
@@ -365,10 +373,13 @@ _IO_new_file_fopen (_IO_FILE *fp, const char *filename, const char *mode,
This means we cannot proceed since the user explicitly asked
for these. */
(void) _IO_file_close_it (fp);
+ free (ccs);
__set_errno (EINVAL);
return NULL;
}
+ free (ccs);
+
assert (fcts.towc_nsteps == 1);
assert (fcts.tomb_nsteps == 1);