Bug 4405

Summary: ecvt(3) access momry not bounded to static array.
Product: [Retired] Red Hat Linux Reporter: erez
Component: glibcAssignee: Cristian Gafton <gafton>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: high    
Version: 6.0   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 1999-08-11 01:59:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description erez 1999-08-06 19:07:04 UTC 
The ecvt man page/spcifications doesn't set a limit
to the number of digits that can be requested.
The following code will crash:
------------------------------------
# include <stdio.h>
# include <stdlib.h>

int main ()
{
        int i, j, n = 0;
        ecvt (2.0/3.0, 10000, &i, &j);
        return 0;
}
----------------------------
it should not crash.

Erez Strauss <erez>
Comment 1 Cristian Gafton 1999-08-11 01:59:59 UTC 
Fixed in the newer releases of glibc available from rawhide.