bugGNU Enscript - Bugs: bug #38998, get_next_token() crash

 
 

bug #38998: get_next_token() crash

Submitter:  Tim Waugh <twaugh>
Submitted:  Wed 15 May 2013 01:56:36 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 10 Feb 2023 10:09:07 PM UTC, comment #2: 


comment #1:

>
> and Debian Buster's version, in case someone wants to look at the gdb.


err ... make that Bullseye (should be the same on Buster but I didn't actually test that).

Bill McGonigle <bill_mcgonigle>
Fri 10 Feb 2023 10:06:30 PM UTC, comment #1: 

Thank you, Tim.  This fixed my crash (greetings from a decade later).

I'm attaching a 2-line reproducer that segfaults with both the git HEAD and Debian Buster's version, in case someone wants to look at the gdb.

Run it with:

./enscript --escapes --word-wrap --media=Letter --columns=2 --output=/dev/null debug.ens

to reproduce.


(file #54345)

 Bill McGonigle <bill_mcgonigle>
Wed 15 May 2013 01:56:36 PM UTC, original submission:  

There is insufficient bounds checking in the get_next_token() function in psgen.c.

1931       else if (bufpos - 2 > w
1932        && ISOCTAL (buffer[bufpos])
1933        && ISOCTAL (buffer[bufpos - 1])
1934        && ISOCTAL (buffer[bufpos - 2])
1935        && buffer[bufpos - 3] == '\\')

bufpos is an unsigned int, but w is an int.  If bufpos < 2, this comparison evaluates as true.

 Tim Waugh <twaugh>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #54345:  debug.ens added by bill_mcgonigle (142B - application/octet-stream)
file #28087:  enscript-bufpos-crash.patch added by twaugh (571B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bill_mcgonigle (Updated the item)
  • -email is unavailable- added by twaugh (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-02-10 bill_mcgonigle Attached File- Added debug.ens, #54345
    2013-05-15 twaugh Attached File- Added enscript-bufpos-crash.patch, #28087

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-f810.
    Corresponding source code