DescriptionLubomir Kundrak
2007-04-03 18:55:33 UTC
Description of problem:
Modules/_localemodule.c:361
356 n1 = strlen(s) + 1;
357 buf = PyMem_Malloc(n1);
358 if (!buf)
359 return PyErr_NoMemory();
360 n2 = strxfrm(buf, s, n1);
In case the transformed string is longer than original string...
(see the PoC for an exapmle)
361 if (n2 > n1) {
362 /* more space needed */
We allocate n2 bytes here:
363 buf = PyMem_Realloc(buf, n2);
364 if (!buf)
365 return PyErr_NoMemory();
And here the string will be n2 chars long and terminating NUL won't
fit and thus the string won't be terminated what can lead to an
information leak in certain rare cases (see the original Debian report
for details).
366 strxfrm(buf, s, n2);
367 }
368 result = PyString_FromString(buf);
369 PyMem_Free(buf);
370 return result;
371 }
372
373 #if defined(MS_WINDOWS)
374 static PyObject*
375 PyLocale_getdefaultlocale(PyObject* self)
Version-Release number of selected component (if applicable):
FC5, FC6, RHEL2.1, RHEL3, RHEL4, RHEL5
How reproducible:
Proof of concept code attached.
Additional info:
See the URL for an original bug report to Debian and PoC by Piotr Engelking.
It contains details on how to reproduce and recognize the flaw.
Description of problem: Modules/_localemodule.c:361 356 n1 = strlen(s) + 1; 357 buf = PyMem_Malloc(n1); 358 if (!buf) 359 return PyErr_NoMemory(); 360 n2 = strxfrm(buf, s, n1); In case the transformed string is longer than original string... (see the PoC for an exapmle) 361 if (n2 > n1) { 362 /* more space needed */ We allocate n2 bytes here: 363 buf = PyMem_Realloc(buf, n2); 364 if (!buf) 365 return PyErr_NoMemory(); And here the string will be n2 chars long and terminating NUL won't fit and thus the string won't be terminated what can lead to an information leak in certain rare cases (see the original Debian report for details). 366 strxfrm(buf, s, n2); 367 } 368 result = PyString_FromString(buf); 369 PyMem_Free(buf); 370 return result; 371 } 372 373 #if defined(MS_WINDOWS) 374 static PyObject* 375 PyLocale_getdefaultlocale(PyObject* self) Version-Release number of selected component (if applicable): FC5, FC6, RHEL2.1, RHEL3, RHEL4, RHEL5 How reproducible: Proof of concept code attached. Additional info: See the URL for an original bug report to Debian and PoC by Piotr Engelking. It contains details on how to reproduce and recognize the flaw.