Report

CVE-2023-6779: glibc __vsyslog_internal heap overflow via long openlog ident

9096ad70-662a-434e-95f7-f06fe83b9b72

Heap buffer overflow in glibc's __vsyslog_internal (misc/syslog.c, glibc-2.37) via the secondary-buffer expansion path. When openlog() is called with a very long ident such that the formatted syslog header exceeds the 1024-byte static buffer bufs[1024], the first __snprintf returns l >= sizeof(bufs). The guard if (0 <= l && l < sizeof bufs) at line 185 then fails, skipping bufsize = l + vl on line 197. bufsize remains 0 (the initializer). The fallback executes buf = malloc((bufsize + 1) * sizeof(char)) -> malloc(1), then __snprintf(buf, l + 1, SYSLOG_HEADER(...)) writes the multi-thousand-byte header into a 1-byte heap allocation, corrupting heap metadata and adjacent allocations.