Bug 219589 – app-office/gnucash: stack smashing attack in function gnc_dense_cal_init

• Status: RESOLVED NEEDINFO
• Product: Gentoo Linux

[Description A. Person 2008-04-28 12:51:40 UTC]

I get the following when trying to open the scheduled transactions editor in any version of gnucash I try:

$ gnucash
gnc.bin-Message: main: binreloc relocation support was disabled at configure time.

Found Finance::Quote version 1.13
*** stack smashing detected ***: gnucash - terminated
gnucash: stack smashing attack in function gnc_dense_cal_init - terminated
Report to http://bugs.gentoo.org/
Killed

# emerge --info
Portage 2.1.4.4 (hardened/amd64/multilib, gcc-3.4.6, glibc-2.6.1-r0, 2.6.25-gentoo-r1 x86_64)
=================================================================
System uname: 2.6.25-gentoo-r1 x86_64 Intel(R) Pentium(R) Dual CPU T2310 @ 1.46GHz
Timestamp of tree: Mon, 28 Apr 2008 11:15:01 +0000
app-shells/bash:     3.2_p17-r1
dev-java/java-config: 1.3.7, 2.1.4
dev-lang/python:     2.4.4-r9
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -march=nocona -pipe -fomit-frame-pointer -fforce-addr"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-O2 -march=nocona -pipe -fomit-frame-pointer -fforce-addr"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig buildpkg distlocks metadata-transfer sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LINGUAS="en_US"
MAKEOPTS="-j1"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise /usr/portage/local/layman/gnome /usr/local/portage"
SYNC="rsync://rsync.us.gentoo.org/gentoo-portage"
USE="X a52 acl acpi alsa amd64 bash-completion berkdb bzip2 cairo caps cdaudio cdr cracklib crypt cups dbus dhcp divx dri dts dvd encode exif ffmpeg firefox flac gd gif gimp gmedia gmp gnutls gpm grammar gsm gtk gtkhtml hal hardened hpn imap java jpeg justify lcms mad madwifi matroska md5sum midi mng mono mp3 mpeg musicbrainz ncurses new-login normalize nptl nptlonly nsplugin offensive ogg opengl oss pam pdf perl pic png python qt3support quicktime quotes readline realmedia regex rt73usb rtc sdl session speex spell sse sse2 ssl startup-notification tagwriting tcpd thesaurus tiff truetype unicode urandom vim-with-x wmf wmp wxwindows x264 xcomposite xml xorg xprint xscreensaver xv zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en_US" USERLAND="GNU" VIDEO_CARDS="i810"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Reproducible: Always

[Comment 1 A. Person 2008-06-17 04:10:51 UTC]

Still happens.  Any ideas?

[Comment 2 Urs Joss 2008-12-18 12:38:29 UTC]

Grant

I don't get this problem. Just out of curiosity: Do you get the same issue with a fresh and new file? It may be releated with your data file.

HTH, Urs

[Comment 3 Mart Raudsepp 2008-12-19 00:45:37 UTC]

Of course input files shouldn't be able to cause stack smashing cases. Security bugs are usually compromised through the means of getting it have some input (data file or otherwise) that triggers it.

[Comment 4 Urs Joss 2008-12-19 04:40:51 UTC]

you're absolutely right, of course
Urs

[Comment 5 A. Person 2008-12-30 01:15:17 UTC]

I switched from a hardened profile to 2008.0 and the problem has disappeared.  Not sure if this bug should be closed.

[Comment 6 Hugo Mildenberger 2009-12-18 22:46:50 UTC]

Regarding missing core dumps, it could be useful to check the hardened reports among #263681, #225563, #288419, #115285, #149292, #180451, #231225, #286587, #202582, #191005 and #219589

[Comment 7 Hugo Mildenberger 2009-12-18 22:49:21 UTC]

(In reply to comment #6)

Sorry, I posted this into the wrong window. See bug #297467 

[Comment 8 Pacho Ramos 2011-03-04 16:05:41 UTC]

Please try with gnucash-2.4

[Comment 9 A. Person 2011-03-05 17:34:25 UTC]

I could be wrong but I don't think I can switch to a hardened profile without reinstalling the system.

[Comment 10 Francisco Blas Izquierdo Riera 2011-03-05 17:43:00 UTC]

Well sort of you don't need to reinstall but recompile:
http://www.gentoo.org/proj/en/hardened/hardenedfaq.xml#hardenedprofile

[Comment 11 Pacho Ramos 2011-03-15 10:04:56 UTC]

+*gnucash-2.4.4 (15 Mar 2011)
+
+  15 Mar 2011; Pacho Ramos <[e-mail]> -gnucash-2.4.0.ebuild,
+  -files/gnucash-2.4.0-fix-tests-linking.patch, +gnucash-2.4.4.ebuild:
+  Version bump with a lot of bugfixes, remove old.
+

Please re-test with this