libio: Avoid _allocate_buffer, _free_buffer function pointers [BZ #23236]
authorFlorian Weimer <fweimer@redhat.com>
Fri, 1 Jun 2018 08:41:03 +0000 (10:41 +0200)
committerFlorian Weimer <fweimer@redhat.com>
Fri, 1 Jun 2018 08:41:03 +0000 (10:41 +0200)
commit4e8a6346cd3da2d88bbad745a1769260d36f2783
treedcf9deeedd5263469fa425574c0ac671a8b43c2a
parent50d004c91c942221b862a4a13a4b5f78cfb0d595
libio: Avoid _allocate_buffer, _free_buffer function pointers [BZ #23236]

These unmangled function pointers reside on the heap and could
be targeted by exploit writers, effectively bypassing libio vtable
validation.  Instead, we ignore these pointers and always call
malloc or free.

In theory, this is a backwards-incompatible change, but using the
global heap instead of the user-supplied callback functions should
have little application impact.  (The old libstdc++ implementation
exposed this functionality via a public, undocumented constructor
in its strstreambuf class.)
ChangeLog
debug/vasprintf_chk.c
libio/memstream.c
libio/strfile.h
libio/strops.c
libio/vasprintf.c
libio/wmemstream.c
libio/wstrops.c