Your message dated Fri, 31 Jan 2020 23:02:11 -0500
with message-id <[email protected]>
and subject line GMP 6.2.0 missing Closes: #863217
has caused the Debian Bug report #863217,
regarding libgmp10:amd64: gmp_snprintf tries to allocate 18 EB on long strings
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
863217: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863217
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libgmp10
Version: 2:6.1.2+dfsg-1
Severity: normal
Tags: security upstream
Forwarded: https://gmplib.org/list-archives/gmp-bugs/2017-May/004157.html
I've reported the following issue upstream. Since GMP tries to
allocate a huge quantity of memory (18 EB) while only a few GB's
may be necessary at most, this may be a security issue (DoS).
Consider the following program:
#include <stdio.h>
#include <gmp.h>
int main(void)
{
int r;
long n = -1;
r = gmp_snprintf (NULL, 0, "%2147483600s%100s%ln", "", "", &n);
printf ("%d %ld\n", r, n);
return 0;
}
On my Debian/unstable x86_64 machine (GMP 6.1.2 provided by the Debian
package), I get after 273 seconds:
GNU MP: Cannot allocate memory (size=18446744071562067968)
Wow! 18 EB! Actually this is close to 2^64. I suspect a conversion
of a negative value to size_t as a consequence of an integer
overflow.
As a comparison, if I just use snprintf (glibc function), I get the
result -1 -1 after 12 seconds (the first value must be negative,
the second one may be regarded as unspecified due to the EOVERFLOW
failure).
-- System Information:
Debian Release: 9.0
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500,
'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64
(x86_64)
Foreign Architectures: i386
Kernel: Linux 4.9.0-3-amd64 (SMP w/12 CPU cores)
Locale: LANG=POSIX, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages libgmp10:amd64 depends on:
ii libc6 2.24-10
libgmp10:amd64 recommends no packages.
libgmp10:amd64 suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 2:6.2.0+dfsg-2
As pointed out by Vincent, this was fixed in the new version according to
upstream's changelog, so closing.
--- End Message ---
--
debian-science-maintainers mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-science-maintainers
