buglibiconv - Bugs: bug #32969, gentranslit: glibc 2.11.1 reports...

 
 

bug #32969: gentranslit: glibc 2.11.1 reports a buffer overrun and aborts when FORTIFY_SOURCE is enabled.

Submitter:  None
Submitted:  Thu 31 Mar 2011 09:55:51 PM UTC
   
 
Category:  Build Severity:  3 - Normal
Item Group:  None Status:  Fix Released
Privacy:  Public Assigned to:  haible
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 31 Mar 2011 10:31:37 PM UTC, comment #3: 

Close enough to my second attempt. Thanks for the quick reply, Bruno.

Ben Noordhuis <bnoordhuis>
Thu 31 Mar 2011 10:26:40 PM UTC, comment #2: 

Thanks a lot for the report. I prefer a slightly different
patch. (The use of snprintf may produce C code that contains
two arrays with the same name.)

Fixed here:
http://git.savannah.gnu.org/gitweb/?p=libiconv.git;a=commitdiff;h=347ec1264f43d87c53fb4eb22cf381673c11d533

Bruno Haible <haible>
Group administrator
Thu 31 Mar 2011 10:24:49 PM UTC, comment #1: 

I take the erroneous part back, `gentranslit` was indeed writing past the end of the buffer. I've amended the patch.

Ben Noordhuis <bnoordhuis>
Thu 31 Mar 2011 09:55:51 PM UTC, original submission:  

Tested against the current master (5124ded) on Ubuntu 10.04.2 (x86_64).


$ gcc -Wall -Wextra -ansi -g -O lib/gentranslit.c -o gentranslit
lib/gentranslit.c: In function ‘main’:
lib/gentranslit.c:29: warning: unused parameter ‘argv’
bnoordhuis@bender:~/src/libiconv$ ./gentranslit < lib/translit.def > lib/translit.h
*** buffer overflow detected ***: ./gentranslit terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x37)[0x2b0b3e88d217]
/lib/libc.so.6(+0xfe0d0)[0x2b0b3e88c0d0]
/lib/libc.so.6(+0xfd539)[0x2b0b3e88b539]
/lib/libc.so.6(_IO_default_xsputn+0xcc)[0x2b0b3e803d1c]
/lib/libc.so.6(_IO_vfprintf+0xf3e)[0x2b0b3e7d42de]
/lib/libc.so.6(__vsprintf_chk+0x99)[0x2b0b3e88b5d9]
/lib/libc.so.6(__sprintf_chk+0x7f)[0x2b0b3e88b51f]
./gentranslit[0x400f5d]
/lib/libc.so.6(__libc_start_main+0xfd)[0x2b0b3e7acc4d]
./gentranslit[0x4007b9]
======= Memory map: ========
00400000-00402000 r-xp 00000000 08:01 2796931                            /home/bnoordhuis/src/libiconv/gentranslit
00601000-00602000 r--p 00001000 08:01 2796931                            /home/bnoordhuis/src/libiconv/gentranslit
00602000-00603000 rw-p 00002000 08:01 2796931                            /home/bnoordhuis/src/libiconv/gentranslit
01d8b000-01dac000 rw-p 00000000 00:00 0                                  [heap]
2b0b3e56c000-2b0b3e58c000 r-xp 00000000 08:01 2899                       /lib/ld-2.11.1.so
2b0b3e58c000-2b0b3e590000 rw-p 00000000 00:00 0
2b0b3e78b000-2b0b3e78c000 r--p 0001f000 08:01 2899                       /lib/ld-2.11.1.so
2b0b3e78c000-2b0b3e78d000 rw-p 00020000 08:01 2899                       /lib/ld-2.11.1.so
2b0b3e78d000-2b0b3e78e000 rw-p 00000000 00:00 0
2b0b3e78e000-2b0b3e908000 r-xp 00000000 08:01 11308                      /lib/libc-2.11.1.so
2b0b3e908000-2b0b3eb07000 ---p 0017a000 08:01 11308                      /lib/libc-2.11.1.so
2b0b3eb07000-2b0b3eb0b000 r--p 00179000 08:01 11308                      /lib/libc-2.11.1.so
2b0b3eb0b000-2b0b3eb0c000 rw-p 0017d000 08:01 11308                      /lib/libc-2.11.1.so
2b0b3eb0c000-2b0b3eb13000 rw-p 00000000 00:00 0
2b0b3eb13000-2b0b3eb29000 r-xp 00000000 08:01 875                        /lib/libgcc_s.so.1
2b0b3eb29000-2b0b3ed28000 ---p 00016000 08:01 875                        /lib/libgcc_s.so.1
2b0b3ed28000-2b0b3ed29000 r--p 00015000 08:01 875                        /lib/libgcc_s.so.1
2b0b3ed29000-2b0b3ed2a000 rw-p 00016000 08:01 875                        /lib/libgcc_s.so.1
7fff1cf4d000-7fff1d84a000 rw-p 00000000 00:00 0                          [stack]
7fff1d896000-7fff1d897000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted


I've written a patchlet that resolves (well, side-steps) the issue. Color diff and patch:

https://github.com/bnoordhuis/libiconv/compare/gentranslit
https://github.com/bnoordhuis/libiconv/compare/gentranslit.patch

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by haible (Posted a comment)
  • -email is unavailable- added by bnoordhuis (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-01-04 haible StatusFixed Fix Released
    2016-11-23 haible CategoryNone Build
    2011-03-31 haible Summarygentranslit: glibc 2.11.1 erroneously reports a buffer overrun and aborts when FORTIFY_SOURCE is enabled. gentranslit: glibc 2.11.1 reports a buffer overrun and aborts when FORTIFY_SOURCE is enabled.
    2011-03-31 haible StatusNone Fixed
        Assigned toNone haible
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code