[Bug 206551] Integer overflow in iconv kernel module

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=206551

--- Comment #1 from CTurt <ertl.chris at gmail.com> ---
Sorry, made a mistake in my report.

Supplying a size of `-1` actually passes `0xffffffffffffffff` to `malloc` and
`copyin`.

However, since `malloc` truncates sizes to 32bit (at least version 9.0 did),
this will result in an allocation of `0xffffffff`, but copy length of
`0xffffffffffffffff`.

If there is enough memory for this allocation to succeed, a heap overflow will
occur.

-- 
You are receiving this mail because:
You are the assignee for the bug.