glibc: CVE-2018-6485: Integer overflow in posix_memalign

Debian Bug report logs - #878159
glibc: CVE-2018-6485: Integer overflow in posix_memalign

Reply or subscribe to this bug.

Toggle useless messages

Message #3 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jakub Wilk <jwilk@jwilk.net>

To: submit@bugs.debian.org

Subject: libc6: posix_memalign(): free(): invalid next size (fast)

Date: Tue, 10 Oct 2017 17:17:11 +0200

Package: libc6
Version: 2.24-17

Some posix_memalign() calls fail catastrophically:

  $ grep memalign test-posix-memalign.c
       return posix_memalign(&p, 0x10, SIZE_MAX - 0x20);

  $ make test-posix-memalign
  cc     test-posix-memalign.c   -o test-posix-memalign

  $ ./test-posix-memalign
  *** Error in `./test-posix-memalign': free(): invalid next size (fast): 0x57a96008 ***
  ...

Backtrace:

#0  0xf7fd7dc9 in __kernel_vsyscall ()
#1  0xf7e2add0 in __libc_signal_restore_set (set=0xffffd160) at ../sysdeps/unix/sysv/linux/nptl-signals.h:79
#2  __GI_raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:48
#3  0xf7e2c297 in __GI_abort () at abort.c:89
#4  0xf7e6638f in __libc_message (do_abort=<optimized out>, fmt=<optimized out>) at ../sysdeps/posix/libc_fatal.c:175
#5  0xf7e6cfc7 in malloc_printerr (action=<optimized out>, str=0xf7f60318 "free(): invalid next size (fast)", ptr=<optimized out>, ar_ptr=0xf7fb2780 <main_arena>) at malloc.c:5049
#6  0xf7e6d806 in _int_free (av=av@entry=0xf7fb2780 <main_arena>, p=p@entry=0x56558000, have_lock=have_lock@entry=1) at malloc.c:3905
#7  0xf7e6f8c3 in _int_memalign (av=av@entry=0xf7fb2780 <main_arena>, alignment=alignment@entry=16, bytes=bytes@entry=4294967263) at malloc.c:4497
#8  0xf7e70eea in _mid_memalign (alignment=16, bytes=4294967263, address=<optimized out>) at malloc.c:3158
#9  0xf7e71028 in _mid_memalign (alignment=alignment@entry=16, bytes=bytes@entry=4294967263, address=<optimized out>) at malloc.c:3121
#10 0xf7e72b7f in __posix_memalign (memptr=0xffffd6ac, alignment=16, size=4294967263) at malloc.c:5071
#11 0x5655556b in main ()


-- System Information:
Architecture: i386

Versions of packages libc6 depends on:
ii  libgcc1  1:7.2.0-8


-- 
Jakub Wilk

Message #6 received at 878159@bugs.debian.org (full text, mbox, reply):

From: Jakub Wilk <jwilk@jwilk.net>

To: 878159@bugs.debian.org

Subject: Bug#878159: libc6: posix_memalign(): free(): invalid next size (fast)

Date: Tue, 10 Oct 2017 17:22:45 +0200

[Message part 1 (text/plain, inline)]

Adding forgotten attachment...

-- 
Jakub Wilk

[test-posix-memalign.c (text/x-csrc, attachment)]

Send a report that this bug log contains spam.