Re: two vulns in uClibc-0.9.33.2

[Waldemar Brodkorb <wbx () uclibc-ng org>]

Hi,
fefe wrote,

> > > I found two vulns in  uClibc-0.9.33.2 (https://uclibc.org/)
>
> > uClibc is dead. Active development happens on uClibc-ng. Is uClibc-ng
> also affected by these issues?
>
>
> uclibc_ng is also affected.
 
I tried to cross-compile attached code and run it in
qemu-system-arm.

What should be the result?

I see a segfault for poc2.c. But this also happens with glibc
based system.

Is the complete app code just plain wrong?
Can you provide full application code and the results showing the
issue?

best regards
 Waldemar

Attachment: poc1.c
Description:

Attachment: poc2.c
Description: