[Bug 206551] Integer overflow in iconv kernel module

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Sun Jan 24 00:39:01 UTC 2016


--- Comment #1 from CTurt <ertl.chris at gmail.com> ---
Sorry, made a mistake in my report.

Supplying a size of `-1` actually passes `0xffffffffffffffff` to `malloc` and

However, since `malloc` truncates sizes to 32bit (at least version 9.0 did),
this will result in an allocation of `0xffffffff`, but copy length of

If there is enough memory for this allocation to succeed, a heap overflow will

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list