From owner-svn-src-all@FreeBSD.ORG Mon May 5 21:51:30 2014 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 3A84FD7D for ; Mon, 5 May 2014 21:51:30 +0000 (UTC) Received: from mail-la0-f46.google.com (mail-la0-f46.google.com [209.85.215.46]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id B149AA4F for ; Mon, 5 May 2014 21:51:29 +0000 (UTC) Received: by mail-la0-f46.google.com with SMTP id e16so990384lan.33 for ; Mon, 05 May 2014 14:51:21 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=1/repdtWv6sNAd8w3YLiRZzPgwarwv11o1mQ1t6GavI=; b=nKM51uUWqkLrgC2HleHQJ5ZSdSAUifTgTC3HdCsCjNeb+/f0nlWJQ2MYXwblOYDDaO YBJrvYcOcssRdMFvoYr1Yu9PW7GrX+qOLumCdTqPUEt9xJWuQHpc9X0EtT999MG9fl8N nxL1pwtafOrxzZqtlzz4sP19ETfjzxmk7sGu5eExDQ34Y+W6OO5z8XT0ugQL+sVVVKr4 n0vMcmmiIxMYOH2xRX85CiP2PMzWhXOhtCQu9XjyC5OIdffnX5I3qAfSjFEl0iILc9u4 F+tSrVetuvw4d5q+P7qZQDPUqp2njTeUy6PeIpecHlNa+w4PlmpiI4nDL5RtLKHbFXrf 9N3A== X-Gm-Message-State: ALoCoQncx/Y276mZGqyMyzZJGvkMhVf44Mu+35RUuBw/He/Sdxnx3UdzH6mZxDU2xcdKt/eomb2w X-Received: by 10.152.29.168 with SMTP id l8mr3792273lah.35.1399326681742; Mon, 05 May 2014 14:51:21 -0700 (PDT) Received: from [192.168.1.2] ([89.169.173.68]) by mx.google.com with ESMTPSA id k9sm1507548lam.11.2014.05.05.14.51.20 for (version=TLSv1.2 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 05 May 2014 14:51:21 -0700 (PDT) Message-ID: <536807D8.9000005@freebsd.org> Date: Tue, 06 May 2014 01:51:20 +0400 From: Andrey Chernov User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 MIME-Version: 1.0 To: David Chisnall , Warner Losh Subject: Re: svn commit: r265367 - head/lib/libc/regex References: <201405051641.s45GfFje086423@svn.freebsd.org> <5367CD77.40909@freebsd.org> <5367EB54.1080109@FreeBSD.org> <3C7CFFB7-5C84-4AC1-9A81-C718D184E87B@FreeBSD.org> <7D7A417E-17C3-4001-8E79-0B57636A70E1@gmail.com> In-Reply-To: Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: 7bit Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, Pedro Giffuni , src-committers X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 May 2014 21:51:30 -0000 On 06.05.2014 1:43, David Chisnall wrote: > While reallocf() is nice, it doesn't address the problem of overflow. It takes a single size, forcing the caller to do the number-of-elements * element-size multiplication, which is the problematic one. If an attacker can control the number of elements, then it's possible to make the multiplication overflow so reallocf() will return a valid pointer to an area of memory that is much smaller than the caller was expecting. For standard malloc/realloc interface it is up to the caller to check n*size not overflows. You must trust caller already does such check. Using calloc() to enforce it instead of caller is semantically wrong, and especially strange when the caller is standard C library under your control. -- http://ache.vniz.net/