From b7da2b0cbb71fec54de45d75a1315db423d20d25 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Thu, 27 Aug 2026 13:34:54 +0200 Subject: [PATCH] stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499) The memmove call did not take into account that __printf_buffer_pad updated the buffer pointers. Fixes commit e88b9f0e5cc50cab57a299dc7efe1a4eb385161d ("stdio-common: Convert vfprintf and related functions to buffers"), which went into glibc 2.37. Reviewed-by: Adhemerval Zanella --- stdlib/Makefile | 1 + stdlib/strfmon_l.c | 5 +++-- stdlib/tst-strfmon-bug34510.c | 33 +++++++++++++++++++++++++++++++++ 3 files changed, 37 insertions(+), 2 deletions(-) create mode 100644 stdlib/tst-strfmon-bug34510.c diff --git a/stdlib/Makefile b/stdlib/Makefile index 750810ee92..a99174082a 100644 --- a/stdlib/Makefile +++ b/stdlib/Makefile @@ -233,6 +233,7 @@ tests := \ tst-setcontext7 \ tst-setcontext8 \ tst-setcontext9 \ + tst-strfmon-bug34510 \ tst-strfmon_l \ tst-strfrom \ tst-strfrom-locale \ diff --git a/stdlib/strfmon_l.c b/stdlib/strfmon_l.c index 620dc1a488..e74f80af54 100644 --- a/stdlib/strfmon_l.c +++ b/stdlib/strfmon_l.c @@ -549,7 +549,8 @@ __vstrfmon_l_buffer (struct __printf_buffer *buf, locale_t loc, /* Now test whether the output width is filled. */ if (buf->write_ptr - startp < width) { - size_t pad_width = width - (buf->write_ptr - startp); + size_t written_width = buf->write_ptr - startp; + size_t pad_width = width - written_width; __printf_buffer_pad (buf, ' ', pad_width); if (__printf_buffer_has_failed (buf)) /* Implies length check. */ @@ -558,7 +559,7 @@ __vstrfmon_l_buffer (struct __printf_buffer *buf, locale_t loc, Otherwise move the field contents in place. */ if (!left) { - memmove (startp + pad_width, startp, buf->write_ptr - startp); + memmove (startp + pad_width, startp, written_width); memset (startp, ' ', pad_width); } } diff --git a/stdlib/tst-strfmon-bug34510.c b/stdlib/tst-strfmon-bug34510.c new file mode 100644 index 0000000000..b187bde1f4 --- /dev/null +++ b/stdlib/tst-strfmon-bug34510.c @@ -0,0 +1,33 @@ +/* Test handling of right-padding in strfmon (bug 34510, CVE-2026-19499). + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include + +static int +do_test (void) +{ + struct support_next_to_fault ntf = support_next_to_fault_allocate (100); + TEST_COMPARE (strfmon (ntf.buffer, ntf.length, "%100n", 1.23), -1); + TEST_COMPARE (errno, E2BIG); + return 0; +} + +#include -- 2.55.0