Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 360383 - <media-libs/libsdl-1.2.14-r5 crashes with gcc ssp due to buffer overflow
Summary: <media-libs/libsdl-1.2.14-r5 crashes with gcc ssp due to buffer overflow
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Games (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Games
URL: http://www.libsdl.org/release/changes...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-03-25 04:14 UTC by Dillon
Modified: 2011-04-13 02:29 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments
Minimal testcase demonstrating the issue (testcase.cc,553 bytes, text/plain)
2011-03-25 04:16 UTC, Dillon
Details
The patch in question, fixes the issue. (libsdl-1.2.14-joystick.patch,1.51 KB, patch)
2011-03-25 04:17 UTC, Dillon
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Dillon 2011-03-25 04:14:41 UTC
libSDL uses an array of int values[5]; to hold ioctl information for joysticks when it should use the correct structure. If I change this declaration to int values[6]; then a workaround is created, however, when another field is added to the kernel joystick structure the software will break again.

Reproducible: Always

Steps to Reproduce:
1.Plug in joystick
2.Run testcase
Actual Results:  
*** stack smashing detected *** on Gentoo if SSP is enabled
possible SIGSEGV depending on compiler settings otherwise.

Expected Results:  
The library functions correctly

(gdb) bt
#0  EV_ConfigJoystick (joystick=0x804f690, fd=5)
    at ./src/joystick/linux/SDL_sysjoystick.c:659
#1  0xa811e9ba in SDL_SYS_JoystickOpen (joystick=0x804f690)
    at ./src/joystick/linux/SDL_sysjoystick.c:828
#2  0xa80f565d in SDL_JoystickOpen (device_index=0) at ./src/joystick/SDL_joystick.c:118
#3  0x08048807 in main (argc=1, argv=0xb88b4b84) at testcase.cc:18

This patch has been available as files/libsdl-1.2.14-joystick.patch since media-libs/libsdl-1.2.14-r5.
I suggest that the patch is backported to the 1.2.13-r1 ebuild. 1.2.14-r6 has only been in tree for 17 days and this is an annoying, but minor bug.

I was not able to reproduce this on amd64/hardened i686/gentoo(via chroot)
The kernel used was hardened-sources-2.6.36-r9 in each case.
ThunderFox ~ # emerge --info libsdl
Portage 2.1.9.42 (hardened/linux/x86, gcc-4.4.5, glibc-2.11.3-r0, 2.6.36-hardened-r9 i686)
=================================================================
                        System Settings
=================================================================
System uname: Linux-2.6.36-hardened-r9-i686-Genuine_Intel-R-_CPU_T2250_@_1.73GHz-with-gentoo-1.12.14
Timestamp of tree: Tue, 22 Mar 2011 07:00:01 +0000
distcc 3.1 i686-pc-linux-gnu [disabled]
ccache version 2.4 [disabled]
app-shells/bash:     4.1_p9
dev-java/java-config: 2.1.11-r3
dev-lang/python:     2.6.6-r2, 3.1.3-r1
dev-util/ccache:     2.4-r9
dev-util/cmake:      2.8.1-r2
sys-apps/baselayout: 1.12.14-r1
sys-apps/sandbox:    2.4
sys-devel/autoconf:  2.13, 2.65-r1
sys-devel/automake:  1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:  2.20.1-r1
sys-devel/gcc:       4.4.5
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   2.2.10
sys-devel/make:      3.81-r2
virtual/os-headers:  2.6.36.1 (sys-kernel/linux-headers)
ACCEPT_KEYWORDS="x86"
ACCEPT_LICENSE="@FREE"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-march=prescott -O2 -pipe -ggdb"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/themes/oxygen-gtk/gtk-2.0 /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/eselect/postgresql /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/sandbox.d /etc/splash /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=prescott -O2 -pipe -ggdb"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests binpkg-logs distlocks fixlafiles fixpackages news nostrip parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
FFLAGS=""
GENTOO_MIRRORS="ftp://gentoo.arcticnetwork.ca/pub/gentoo/ ftp://distro.ibiblio.org/pub/linux/distributions/gentoo/ ftp://distro.ibiblio.org/pub/linux/distributions/gentoo/"
LANG="en_US.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="en en_US"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/var/lib/layman/roslin /var/lib/layman/techwolf /usr/portage/local"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X aac acl acpi alsa ao avahi berkdb bonjour bzip2 cairo caps cdda cddb cdinstall clamav cli consolekit cracklib crypt css cups cvs cxx daap dbus dga direcftb directfb djvu dri dv dvd dvdr dvdread emovix encode exif faac faad fbcon fbcondecor ffmpeg flac fortran gcj gdbm geoip gif git gnutls gphoto2 gpm graphviz gstreamer h323 hardened iconv id3tag ieee1394 imagemagick imlib iphone ipod java jpeg jpeg2k kde kontact lame laptop lcms libnotify libsamplerate lm_sensors mad mikmod mmx mmxext modules mp3 mp4 mpeg mudflap multislot musicbrainz mysql ncurses networkmanager nis nls nptl nptlonly nsplugin ogg openal opengl openmp otr pam pcmcia pcre pdf perl phonon pic png portaudio postgres pppd pulseaudio python qt3support qt4 quicktime rdesktop readline rtc ruby samba scanner sdl semantic-desktop session silc sip smp snmp socks5 speex spell sqlite sqlite3 sse sse2 ssl startup-notification subversion svg sysfs sysvipc taglib tcpd theora threads tiff truetype twolame udev unicode upnp urandom usb v4l v4l2 vcd videos vnc vorbis wav webkit wifi win32codecs wmf wxwindows x264 x86 xcomposite xine xml xorg xv xvid xvmc yahoo zeroconf zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev mouse synaptics keyboard joystick" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en en_US" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="fbdev vesa intel" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, MAKEOPTS, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

=================================================================
                        Package Settings
=================================================================

media-libs/libsdl-1.2.13-r1 was built with the following:
USE="X alsa audio dga directfb fbcon joystick opengl pulseaudio video xv -aalib -custom-cflags -esd -ggi -libcaca -nas -oss -svga -tslib -xinerama"
Comment 1 Dillon 2011-03-25 04:16:17 UTC
Created attachment 267159 [details]
Minimal testcase demonstrating the issue

Note: requires a joystick plugged in to reproduce the issue
Comment 2 Dillon 2011-03-25 04:17:38 UTC
Created attachment 267161 [details, diff]
The patch in question, fixes the issue.
Comment 3 Dillon 2011-03-25 04:21:05 UTC
Added 1.2.13-14 changelog
may be of interest for future stabilization.
Comment 4 Dillon 2011-04-13 02:29:55 UTC
Fixed due to https://bugs.gentoo.org/362005