Description of problem:
glibc 2.9 through 2.12 have a bug in string searching algorithms which was just recently fixed upstream (note that glibc 2.11 introduced a replacement strstr for SSE4.2 platforms that avoids the bug on strstr and strcasestr, but at the expense of using a quadratic implementation instead of a linear version).  Since this bug can be triggered in any number of other packages, the upstream patch should be backported into the Fedora version of glibc.  http://sourceware.org/bugzilla/show_bug.cgi?id=12092

Version-Release number of selected component (if applicable):
glibc-2.12.1-2.x86_64
glibc-2.12.1-2.i686

How reproducible:
100% reproducible on problematic search patterns.  However, a machine with SSE4.2 hides the problem unless you use memmem.  Also, the problematic search patterns are not necessarily typical searches: the needle has to be periodic and at least 32 bytes, and the haystack has to match in most but not all of the periods of the needle to trigger the false positive match; so packages that use strstr() on hard-coded needles rather than on arbitrary user input are most likely immune.

Steps to Reproduce:
1. This demonstrates an example of existing packages that use strstr() on arbitrary input, and uses a shorter input string than the one listed in the glibc bug report.  First, validate that this machine is not using SSE4.2:
grep sse4_2 /proc/cpuinfo | wc -l
2. echo 'index(
;:11-:12-:12-:12-:12-:12-:12-:12-:12.:12.:12.:12.:12.:12.:12.:12.:12-,
:12-:12-:12-:12-:12-:12-:12-:12-)' | m4
  
Actual results:
1. 0
2. 37

Expected results:
1. 0
2.-1

Additional info: