| commit | feba48309a227fe40feb3a87cbe900015021ac73 | |
| author | Ben Pfaff <blp@cs.stanford.edu> | |
| Sun, 27 Aug 2017 19:32:50 +0000 (27 12:32 -0700) | ||
| committer | Ben Pfaff <blp@cs.stanford.edu> | |
| Sun, 27 Aug 2017 19:32:50 +0000 (27 12:32 -0700) | ||
| tree | c54c87712385a5bff6e03671586b8c691334b413 | treesnapshot (tar.gz zip) |
| parent | 7891023bc75024553f2564017b685cdb13eeec33 | commitdiff |
data-out: Pass correct width to value_str() in output_AHEX().
AHEX16 is short enough to work as a short string, but output_AHEX() was
treating it as a long string, which caused string data to be dereferenced
as a pointer.
CVE-2017-12958.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1482429.
See also http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12958.
See also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12958.
Found by team OWL337, using the collAFL fuzzer.
AHEX16 is short enough to work as a short string, but output_AHEX() was
treating it as a long string, which caused string data to be dereferenced
as a pointer.
CVE-2017-12958.
See also https://bugzilla.redhat.com/show_bug.cgi?id=1482429.
See also http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12958.
See also http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12958.
Found by team OWL337, using the collAFL fuzzer.
| NEWS | diffblobblamehistory | |
| src/data/data-out.c | diffblobblamehistory | |
| tests/data/data-out.at | diffblobblamehistory |