buffer overflow in strfmon test harness

[wagle]

Hi --

The test harness for strfmon in redhat 7.3's version of glibc resides in

 glibc-2.2.5/localedata/tests-mbwc/tst_strfmon.c

It defines a buffer of 32 chars.  But the test data in

  glibc-2.2.5/localedata/tests-mbwc/dat_strfmon.c

contains a buffer size (nbt) of "33" in 11 of of the 45 test cases.

This results in the byte located immediately after the buffer being
zeroed, probably by the code:

      /* We clear the last available byte so we can find out whether
         the numeric representation is too long.  */
      s[maxsize - 1] = '\0';

The test harness 1probably needs to check for buffer overflows
specified by the user (ie, die noisely if "nbt > MONSIZE") or flaws in
the implementation (ie, writing beyond the user specified end of
buffer).

I will solve it for myself in the short term by making the buffer
larger, but I don't believe that is the correct solution.

Have fun!

-- Perry Wagle

PS.  I detected it with the newest version of stackguard, beginning
its torture test ("build world").  This was the first buffer overflow
"in the wild" that it detected.