Wed 03 Mar 2010 01:37:51 PM UTC, comment #1:
Hi
Thank you for the report. Your patch should indeed fix the problem (I have not tested it, though).
Accidentally, Juergen Weigert reported the same problem and also provided a patch, see http://savannah.nongnu.org/patch/?7078
Some commiter should apply one of these patches. (I recommend the patch 7078 since it works even buf[80] is resized.) And probably do a release, too. Otherwise we might see more duplicated effort.
|
Wed 03 Mar 2010 11:52:10 AM UTC, original submission:
A rebuild of simulavr for Ubuntu Lucid detected a possible buffer overflow:
if i486-linux-gnu-gcc -DHAVE_CONFIG_H -I. -I. -I. -Wall -Winline -Werror -I../src/getopt -Wall -g -O2 -MT eeprom.o -MD -MP -MF ".deps/eeprom.Tpo" -c -o eeprom.o eeprom.c; \
then mv -f ".deps/eeprom.Tpo" ".deps/eeprom.Po"; else rm -f ".deps/eeprom.Tpo"; exit 1; fi
cc1: warnings being treated as errors
In file included from /usr/include/string.h:640,
from eeprom.c:30:
In function 'strncat',
inlined from 'eeprom_dump_core' at eeprom.c:395:
/usr/include/bits/string3.h:154: error: call to __builtin___strncat_chk might overflow destination buffer
make[4]: *** [eeprom.o] Error 1
This is due to wrong use of strncat(). The third parameter of this function limits the number of characters copied, not the total size of buffer.
The proposed fix (applies to 0.1.2.6 as well) is:
--- simulavr-0.1.2.2.orig/src/eeprom.c
+++ simulavr-0.1.2.2/src/eeprom.c
@@ -392,7 +392,7 @@
line[0] = '\0';
}
snprintf (buf, 80, "%02x ", storage_readb (eeprom->stor, i));
- strncat (line, buf, 80);
+ strncat (line, buf, 80 - strlen(line) - 1);
}
if (dup > 0)
{
--- simulavr-0.1.2.2.orig/src/memory.c
+++ simulavr-0.1.2.2/src/memory.c
@@ -416,7 +416,7 @@
line[0] = '\0';
}
snprintf (buf, 80, "%02x ", mem_read (mem, i));
- strncat (line, buf, 80);
+ strncat (line, buf, 80 - strlen(line) - 1);
}
if (dup > 0)
{
--- simulavr-0.1.2.2.orig/src/flash.c
+++ simulavr-0.1.2.2/src/flash.c
@@ -252,7 +252,7 @@
line[0] = '\0';
}
snprintf (buf, 80, "%04x ", flash_read (flash, i));
- strncat (line, buf, 80);
+ strncat (line, buf, 80 - strlen(line) - 1);
}
if (dup > 0)
{
|