bugtexinfo - GNU documentation system - Bugs: bug #32122, unsufficient stack space for...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #32122: unsufficient stack space for sprintf

Submitted by:  Kees Cook <keescook>
Submitted on:  Thu 13 Jan 2011 10:24:24 PM UTC  
 
Category: makeinfoRelease: 4.13a
Priority: 5 - NormalSeverity: 3 - Normal
Item Group: bugPrivacy: Public
Open/Closed: ClosedAssigned to: None
Status: Fixed

Sat 15 Jan 2011 12:26:23 AM UTC, comment #2:

Thanks for the report.

The first was fixed a while ago.

The second would seem to require a document with more than 9999 chapters/sections/whatever (and the C implementation is getting replaced completely), but I increased the value anyway, no harm in it.

Karl Berry <karl>
Project Administrator
Thu 13 Jan 2011 10:26:07 PM UTC, comment #1:

This was reported to Ubuntu:
https://bugs.launchpad.net/texinfo/+bug/569802

Kees Cook <keescook>
Thu 13 Jan 2011 10:24:24 PM UTC, original submission:

makeinfo/sectioning.c:

char s[1];
sprintf (s, "%c", numbers[0] + 64);
return xstrdup (s);

sprintf() above with write 2 bytes, even though s is only 1. Attached patch fixes this and nearby overflow.

Kees Cook <keescook>

 

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by karl (Posted a comment)
  • -unavailable- added by keescook (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 15 Jan 2011 12:26:23 AM UTCkarlOpen/ClosedOpen=>Closed
      StatusNone=>Fixed
    Thu 13 Jan 2011 10:25:43 PM UTCkeescookAttached File-=>Added minor-buffer-size-fix.patch, #22404

    Back to the top


    Powered by Savane 3.1-cleanup1