gcc-4.5 manifests buffer overflow with app-arch/tar-1.{22,23} Reproducible: Always
Created attachment 229107 [details] patch from fedora-{12,13} This patch seems to fix the problem for me.
Confirmed, reproducable test case is to emerge flac (or any other package using libtoolize). Failure mode: * Running libtoolize --copy --force --install --automake ... *** buffer overflow detected ***: tar terminated ======= Backtrace: ========= /lib/libc.so.6(__fortify_fail+0x37)[0x7f8510433537] /lib/libc.so.6(+0xe4350)[0x7f8510431350] tar[0x409ebe] tar[0x40a148] tar[0x40a622] tar[0x40a3af] tar[0x40b415] tar[0x41de1a] /lib/libc.so.6(__libc_start_main+0xfd)[0x7f851036bb6d] tar[0x403a69] Portage 2.2_rc67 (default/linux/amd64/10.0/developer, gcc-4.5.0, glibc-2.11-r1, 2.6.34-rc5-00089-gc81eddb x86_64) ================================================================= System uname: Linux-2.6.34-rc5-00089-gc81eddb-x86_64-Six-Core_AMD_Opteron-tm-_Processor_2435-with-gentoo-2.0.1 Timestamp of tree: Unknown app-shells/bash: 4.1_p5 dev-java/java-config: 2.1.10 dev-lang/python: 2.6.5-r1, 3.1.2-r2 dev-util/cmake: 2.8.1-r1 sys-apps/baselayout: 2.0.1 sys-apps/openrc: 0.6.1-r1 sys-apps/sandbox: 2.2 sys-devel/autoconf: 2.13, 2.65 sys-devel/automake: 1.9.6-r3, 1.10.3, 1.11.1 sys-devel/binutils: 2.20.1 sys-devel/gcc: 4.4.3, 4.5.0 sys-devel/gcc-config: 1.4.1 sys-devel/libtool: 2.2.6b virtual/os-headers: 2.6.33 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA dlj-1.1 sun-bcla-java-vm skype-eula" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -march=native -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/X11/xkb /var/lib/hsqldb" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O2 -march=native -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--with-bdeps=y --complete-graph --keep-going" FEATURES="assume-digests collision-protect cvs distlocks fixpackages multilib-strict news parallel-fetch preserve-libs protect-owned sandbox sfperms sign splitdebug strict unmerge-logs unmerge-orphans userfetch userpriv usersandbox" GENTOO_MIRRORS="http://mirror.bytemark.co.uk/gentoo/" LANG="en_GB.UTF-8" LC_ALL="en_GB.UTF-8" LDFLAGS="-Wl,-O1,--as-needed,--hash-style=gnu" MAKEOPTS="-j12" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/cvs/gentoo-x86" PORTDIR_OVERLAY="/usr/local/portage" SYNC="cvs://chainsaw@cvs.gentoo.org:/var/cvsroot" USE="16bit 3dnow 3dnowext 7zip S3TC X a52 aac aalib ace acpi adns adplug alac allegro alsa amd64 amr amrnb amrwb animgif aotuv applet archive aspell async asyncns audacious audiofile autoipd avahi bash-completion beagle berkdb binary-drivers binfilter bluetooth bonjour bs2b bzip2 cacao cairo calendar canberra caps cardbus cdaudio cdda cddb cdparanoia cdr cdrkit cdrom cegui chardet chipcard chm cleartype cli consolekit cpio cracklib crypt css cups curl cxx dbus devhelp device-mapper devil dhcp dhcpcd dirac disk-partition diskio divx djbfft djvu dmi dns double-precision dri drm dtmf dts dv dvd dvdr dvi ecc eds elf emboss enca encode epiphany erandom evo exif exiv2 expat extras faac faad fam fat fbcon fbcondecor ffmpeg fftw flac fortran fpx ftp fts3 fuse g15 gconf gcrypt gd gdbm gdl gdm gdu gecko gedit gif gimp glade glep glib glitz glut gmedia gnome gnome-keyring gnomecd gnutls gpg gphoto2 graphite graphviz gs gsm gstreamer gtk gzip h323 hal hddtemp hfs howl-compat hpn http ical icons iconv icu id3 id3tag idn ieee1394 imagemagick imap imlib inkjar inotify iplayer ipod ipv6 irda jabber java javascript jbig jce john jpeg jpeg2k juju kdrive keyring lame lcms ldap libburn libcaca libffi libgcrypt libnl libnotify libsamplerate libsigsegv libssh2 libwww lilo logrotate lto lzma lzo mad magic maps md5sum mdnsresponder-compat mikmod mime mjpeg mmap mmx mmxext mng modplug modules moonlight mp2 mp3 mp4 mpeg mplayer mudflap multilib musepack musicbrainz nano-syntax nautilus ncurses nemesi neon network network-cron networkmanager nio2 nls nptl nptlonly nsplugin nss nut nuv nvidia ogg openal opencore-amr openexr opengl openssl otr ots pam pango pccts pcre pdf perl physfs pic pidgin pipechan png pnm policykit posix ppds pppd pulseaudio python qt-static rar rdesktop readline realtime reflection rle rss rtc scenarios schroedinger screenshot sdl secure-delete session sftp shorten sid sip smp sms sndfile sound soup sourceview sox speex spell spl sqlite srt sse sse2 ssl ssse3 startup-notification subtitles svg svgz sysfs syslog szip t1lib taglib tagwriting theora thesaurus threads thumbnail tiff timidity tls tordns totem tracker trayicon truetype tta twolame unicode urandom usb v4l2 valgrind vcd vnc vorbis vorbis-psy vte wav wavpack webkit wifi wma wmf wmp wxwidgets x264 xcb xcomposite xface xinerama xml xmp xorg xpm xsettings xslt xulrunner xv xvid xvmc yv12 zeroconf zlib" ALSA_CARDS="oxygen" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CAMERAS="ptp2" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="serdisplib" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="radeon radeonhd" Unset: CPPFLAGS, CTARGET, FFLAGS, INSTALL_MASK, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
+*tar-1.23-r1 (25 Apr 2010) + + 25 Apr 2010; <chainsaw@gentoo.org> +tar-1.23-r1.ebuild, + +files/tar-1.23-strncpy.patch: + Glibc built with GCC 4.5 will notice a buffer overflow in the handling of + OLD_GNU magic bytes and kill us. Apply a Fedora patch scavenged by Emil + Karlson to avoid this happening; closes bug #317139.
*** Bug 321257 has been marked as a duplicate of this bug. ***
How about stabilyzing -r1 to avoid further problems?
there are no problems for stable and unstable users
(In reply to comment #6) > there are no problems for stable and unstable users > We could add a blocker to older versions of tar against gcc-4.5
sounds like overkill. "mommy, it hurts when i touch the fire" ... just wait for the versions to shake out like normal. running gcc-4.5.0 on an otherwise stable system is a terrible idea today and will be for months.
It just was an idea to simplify things, yes, running gcc 4.5.0 on stable system maybe is not a good idea, but the fact is <tar-1.22-r1 is not supported with gcc 4.5.0 (nor today nor never), so it does not hurt to have it as a blocker. (Just a constructive idea)
taking about gcc-4.5 and stable today is only noise. there's plenty of work to do in *unstable* before stable can even be *thought* about. so if you want to help out with broken packages in *unstable*, then by all means. but please do not comment on stable for quite a while except to add bugs to the open tracker.
