sysdeps/i386/ldbl2mpn.c in glibc before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf.
sysdeps/i386/ldbl2mpn.c in glibc before 2.23 on x86 targets has a stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf.
https://sourceware.org/bugzilla/show_bug.cgi?id=26649 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=681900d29683722b1cb0a8e565a0585846ec5a61
Vulmon