Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 481802 - app-accessibility/brltty-4.5-r1: some speech.c files read outside the bounds of arrays
Summary: app-accessibility/brltty-4.5-r1: some speech.c files read outside the bounds ...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Chris Brannon (RETIRED)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-08-20 23:21 UTC by SpanKY
Modified: 2013-08-24 23:43 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SpanKY gentoo-dev 2013-08-20 23:21:40 UTC
i built brltty-4.5 and got these warnings:
 * QA Notice: Package triggers severe warnings which indicate that it
 *            may exhibit random runtime failures.
 * ./speech.c:78:36: warning: array subscript is above array bounds [-Warray-bounds]
 * ./speech.c:102:41: warning: array subscript is above array bounds [-Warray-bounds]

and indeed, if we look at the code, it's doing just that.

./Drivers/Speech/MultiBraille/speech.c:
static unsigned char latin2cp437[128] = {...};
...
static void
spk_say (..., const unsigned char *buffer, ...)
{
...
  unsigned char c;
...
  c = buffer[i];
  if (c >= 128) c = latin2cp437[c];
...

fairly obvious -- the array is 128 bytes long, but we only ever index it with values that are 128 or bigger.

the other speech.c files have similar errors on these latin2cp437 arrays.  i'm guessing that the code should actually be:
  if (c >= 128) c = latin2cp437[c - 128];

but i really have no idea.
Comment 1 Chris Brannon (RETIRED) gentoo-dev 2013-08-22 03:16:21 UTC
This was fixed in the brltty svn repo today.
There was a second range-checking issue that was also fixed.
I'll apply both of these shortly.
I assume you found this with -Wall in CFLAGS?
Comment 2 Chris Brannon (RETIRED) gentoo-dev 2013-08-23 18:21:14 UTC
Fixed in app-accessibility/brltty-4.5-r2.
Comment 3 SpanKY gentoo-dev 2013-08-24 23:43:34 UTC
(In reply to Chris Brannon from comment #1)

i don't think you need -Wall for that.  just optimization (-O2) and security warnings (the latter of which we enable by default in Gentoo's gcc).