3 ms·
Glibc: realloc() ncopies 32-bit integer overflow
- nh2 8y agoPerhaps interesting to discuss on HN is --- Personally I'm a bit sad that ~20 years old code we all depend on has so obvious bugs. I found this issue after finding that all 3 glibc malloc memory use info functions (malloc_stats(), mallinfo() and malloc_info()) are bugged and report completely wrong numbers (bug 24026, bug 21556). For malloc_stats() it was an integer overflow due to `unsigned int` being used for counting bytes. It is very well known among programmers for decades that `unsigned int` is not the right type for buffer lengths. At that point, I just searched for "unsigned int" in malloc.c to see if there are any similar problems, and found this realloc() bug within a minute. It seems nobody does in practice read the code of fundamental components running on billions of devices. --- How can we arrive at good software that does nontrivial things, if even casual reading reveals serious issues in the basic building blocks we all use?
- qubex 8y agoThe argument that “open source leads to greater security” only holds true if thousands of eyeballs really do look at the code.