Bugzilla Bug 133699

Stack trace:


Other information:
I can confirm the problem, but I cannot confirm original report analysis:

vsprintf (buf, fmt, *args2) correctly returns:
 buf = (gchar *) 0xebb4a0 "Failed to load:\nImage file '%p%p%p%p.bmp' contains
no data"

The real problem seems to be message_create_dialog(), which provides the string
message_format to gtk_message_dialog_new(), which is defined as
GtkWidget*  gtk_message_dialog_new          (GtkWindow *parent,
                                             GtkDialogFlags flags,
                                             GtkMessageType type,
                                             GtkButtonsType buttons,
                                             const gchar *message_format,
                                             ...);

Affected are all versions except the old ones using gtk_label_new()

I am not sure about correctness of alloc = nearest_pow (MAX(len + 1, 1024));
Maybe 1024 should be MAXPATHLEN.

And I don't know, why exactly there are two variables with the same varargs
contents - one is analysed to get the proper length, one is used for
formatting.

gnome-office please provide fixed ebuilds, thank you.

any news?

new ebuild (dia-0.95.1.ebuild) in tree, fix for this sec bug should be in this
version.

Thanks a lot John.

Arches please test dia-0.95.1 and mark stable, thanks.

ppc stable

stable on ppc64

Stable on amd64 and x86...

sparc stable.

alpha done.

GLSA 200606-03

ia64 don't forget to mark stable to benifit from the GLSA.