Hi,

because now all occurrences are eliminated, the problem is too eliminated. :-) Closed!

cu, Thomas

A rebuild of simulavr for Ubuntu Lucid detected a possible buffer overflow:

if i486-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I. -I.    -Wall -Winline -Werror -I../src/getopt -Wall -g -O2 -MT eeprom.o -MD -MP -MF ".deps/eeprom.Tpo" -c -o eeprom.o eeprom.c; \
then mv -f ".deps/eeprom.Tpo" ".deps/eeprom.Po"; else rm -f ".deps/eeprom.Tpo"; exit 1; fi
cc1: warnings being treated as errors
In file included from /usr/include/string.h:640,
                 from eeprom.c:30:
In function 'strncat',
    inlined from 'eeprom_dump_core' at eeprom.c:395:
/usr/include/bits/string3.h:154: error: call to __builtin___strncat_chk might overflow destination buffer
make[4]: * [eeprom.o] Error 1

This is due to wrong use of strncat(). The third parameter of this function limits the number of characters copied, not the total size of buffer.

The proposed fix (applies to 0.1.2.6 as well) is:

--- simulavr-0.1.2.2.orig/src/eeprom.c
+++ simulavr-0.1.2.2/src/eeprom.c
@@ -392,7 +392,7 @@
             line[0] = '\0';
         }
         snprintf (buf, 80, "%02x ", storage_readb (eeprom->stor, i));
-        strncat (line, buf, 80);
+        strncat (line, buf, 80 - strlen(line) - 1);
     }
     if (dup > 0)
     {
--- simulavr-0.1.2.2.orig/src/memory.c
+++ simulavr-0.1.2.2/src/memory.c
@@ -416,7 +416,7 @@
             line[0] = '\0';
         }
         snprintf (buf, 80, "%02x ", mem_read (mem, i));
-        strncat (line, buf, 80);
+        strncat (line, buf, 80 - strlen(line) - 1);
     }
     if (dup > 0)
     {
--- simulavr-0.1.2.2.orig/src/flash.c
+++ simulavr-0.1.2.2/src/flash.c
@@ -252,7 +252,7 @@
             line[0] = '\0';
         }
         snprintf (buf, 80, "%04x ", flash_read (flash, i));
-        strncat (line, buf, 80);
+        strncat (line, buf, 80 - strlen(line) - 1);
     }
     if (dup > 0)
     {