java_props_md.c allocates a 64 byte buffer for the return value of setlocale on the stack. However, there appears to be no set limit on the return value:
http://pubs.opengroup.org/onlinepubs/009604499/functions/setlocale.html and no check in the code to ensure that its length is 63 characters or less (allowing for '\0'). While language and country are defined by ISO, I don't believe there's any limit on the optional encoding and variant entries. This patch: http://cr.openjdk.java.net/~andrew/buffer_overflow/webrev.01/jdk.patch replaces the allocation with a dynamic buffer based on the length of lc. Original bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=497666 Ok for tl? If so, can I have a bug ID? Thanks, -- Andrew :) Free Java Software Engineer Red Hat, Inc. (http://www.redhat.com) PGP Key: 248BDC07 (https://keys.indymedia.org/) Fingerprint = EC5A 1F5E C0AD 1D15 8F1F 8F91 3B96 A578 248B DC07
