Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 310379 - games-roguelike/tome-2.3.5: buffer overflow during save
Summary: games-roguelike/tome-2.3.5: buffer overflow during save
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Games (show other bugs)
Hardware: x86 Linux
: High normal (vote)
Assignee: Gentoo Games
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-03-20 13:58 UTC by Markus Schöngart
Modified: 2010-03-20 20:26 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments
Enlarge the buffer in question. (2.3.5-buffer-overflow.patch,563 bytes, text/plain)
2010-03-20 14:03 UTC, Markus Schöngart
Details
Apply the buffer overflow patch. (tome-2.3.5.ebuild.patch,437 bytes, patch)
2010-03-20 14:04 UTC, Markus Schöngart
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Markus Schöngart 2010-03-20 13:58:19 UTC
ToME always crashes when the player wants to save and has a background story that is too long.

Reproducible: Always

Steps to Reproduce:
1. Start tome
2. Generate a character of any class with a background story longer than 80 characters (especially, the auto-generated descriptions typically will be longer).
3. Start the game.
4. Save the game (^X).
Actual Results:  
Game crashed with this terminal output:
*** buffer overflow detected ***: tome - terminated
tome: buffer overflow attack in function <unknown> - terminated
Report to http://bugs.gentoo.org/

Expected Results:  
Successful save and no crash.

I recompiled and ran the program through valgrind, which showed that the buffer overflow occured in src/loadsave.c (do_extra).  Quick code examination suggested that character descriptions longer than 79 characters may not work, descriptions longer than 80 characters may cause the observed buffer overflow.  Unfortunately, the default descriptions are already longer than 80 characters, typically, causing the game to crash on save for most players.
Comment 1 Markus Schöngart 2010-03-20 14:03:57 UTC
Created attachment 224385 [details]
Enlarge the buffer in question.

This patch seems to fix the problem for default background stories.  Problem will reappear with background stories exceeding 1kb.
Comment 2 Markus Schöngart 2010-03-20 14:04:31 UTC
Created attachment 224387 [details, diff]
Apply the buffer overflow patch.
Comment 3 Tupone Alfredo gentoo-dev 2010-03-20 20:26:42 UTC
Hopefully that bug is now fixed. 
I did not apply your changes as I imagine it changes the format of the saved files.
I saw the patch on the 3.0 version and they fixed using strncpy instead of strcpy.
I just did fix the ./lib/edit/p_info.txt reducing the size of the longest string to 80 chars. 
It seems to work.

Thanks however for report and analysis and reopen it if you see the same behaviour again.