bugSimulavr: an AVR simulator - Bugs: bug #29049, wrong use of strncat()

 
 

bug #29049: wrong use of strncat()

Submitter:  Ilya Barygin <conscious>
Submitted:  Wed 03 Mar 2010 11:52:10 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Component Version:  * simulavr
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 06 Oct 2014 05:05:16 PM UTC, comment #2: 

Hi,

because now all occurrences are eliminated, the problem is too eliminated. :-) Closed!

cu, Thomas

Thomas K. <tomk>
Group administrator
Wed 03 Mar 2010 01:37:51 PM UTC, comment #1: 

Hi

Thank you for the report. Your patch should indeed fix the problem (I have not tested it, though).

Accidentally, Juergen Weigert reported the same problem and also provided a patch, see http://savannah.nongnu.org/patch/?7078

Some commiter should apply one of these patches. (I recommend the patch 7078 since it works even buf[80] is resized.) And probably do a release, too. Otherwise we might see more duplicated effort.

Petr Hluzin <petrh>
Group Member
Wed 03 Mar 2010 11:52:10 AM UTC, original submission:  

A rebuild of simulavr for Ubuntu Lucid detected a possible buffer overflow:

if i486-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I. -I.    -Wall -Winline -Werror -I../src/getopt -Wall -g -O2 -MT eeprom.o -MD -MP -MF ".deps/eeprom.Tpo" -c -o eeprom.o eeprom.c; \
then mv -f ".deps/eeprom.Tpo" ".deps/eeprom.Po"; else rm -f ".deps/eeprom.Tpo"; exit 1; fi
cc1: warnings being treated as errors
In file included from /usr/include/string.h:640,
                 from eeprom.c:30:
In function 'strncat',
    inlined from 'eeprom_dump_core' at eeprom.c:395:
/usr/include/bits/string3.h:154: error: call to __builtin___strncat_chk might overflow destination buffer
make[4]: * [eeprom.o] Error 1

This is due to wrong use of strncat(). The third parameter of this function limits the number of characters copied, not the total size of buffer.

The proposed fix (applies to 0.1.2.6 as well) is:

--- simulavr-0.1.2.2.orig/src/eeprom.c
+++ simulavr-0.1.2.2/src/eeprom.c
@@ -392,7 +392,7 @@
             line[0] = '\0';
         }
         snprintf (buf, 80, "%02x ", storage_readb (eeprom->stor, i));
-        strncat (line, buf, 80);
+        strncat (line, buf, 80 - strlen(line) - 1);
     }
     if (dup > 0)
     {
--- simulavr-0.1.2.2.orig/src/memory.c
+++ simulavr-0.1.2.2/src/memory.c
@@ -416,7 +416,7 @@
             line[0] = '\0';
         }
         snprintf (buf, 80, "%02x ", mem_read (mem, i));
-        strncat (line, buf, 80);
+        strncat (line, buf, 80 - strlen(line) - 1);
     }
     if (dup > 0)
     {
--- simulavr-0.1.2.2.orig/src/flash.c
+++ simulavr-0.1.2.2/src/flash.c
@@ -252,7 +252,7 @@
             line[0] = '\0';
         }
         snprintf (buf, 80, "%04x ", flash_read (flash, i));
-        strncat (line, buf, 80);
+        strncat (line, buf, 80 - strlen(line) - 1);
     }
     if (dup > 0)
     {

Ilya Barygin <conscious>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tomk (Posted a comment)
  • -email is unavailable- added by petrh (Posted a comment)
  • -email is unavailable- added by conscious (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-10-06 tomk StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code