Bug 933597 – x11-base/xorg-server-21.1.13-r1 - [ncurses-6.5] [gcc-15] /.../string_fortified.h: error: _builtin_strncpy offset [130, 319] from the object at name is out of the bounds of r

• Status: CONFIRMED
• Product: Gentoo Linux

[Description Toralf Förster 2024-06-05 08:04:14 UTC]

                 from /usr/include/X11/Xtrans/Xtransint.h:79,
                 from /usr/include/X11/Xtrans/transport.c:55,
                 from ../xorg-server-21.1.13/os/xstrans.c:17:
In function strncpy,
    inlined from _XSERVTransGetHostname at /usr/include/X11/Xtrans/Xtrans.c:1351:5,
    inlined from _XSERVTransConvertAddress at /usr/include/X11/Xtrans/Xtransutil.c:188:12:
/usr/include/bits/string_fortified.h:95:10: error: __builtin_strncpy offset [130, 319] from the object at name is out of the bounds of referenced subobject nodename with type char[65] at offset 65 [-Werror=array-bounds=]
   95 |   return __builtin___strncpy_chk (__dest, __src, __len,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  -------------------------------------------------------------------

  This is an unstable amd64 chroot image at a tinderbox (==build bot)
  name: 23.0_desktop_systemd-20240602-172143

  UNMASKED:
  <sys-devel/gcc-15.0.9999:15
    Please re-assign to toolchain@ if you get a test failure in C, C++, or Fortran code which makes no sense.
  >=sys-libs/ncurses-6.5
    Issues involving opaque types / incomplete typedefs should block bug 930805

  The attached etc.portage.tar.xz has all details.
  -------------------------------------------------------------------

gcc-config -l:
 [1] x86_64-pc-linux-gnu-15 *
clang/llvm (if any):
clang version 18.1.6
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm/18/bin
Configuration file: /etc/clang/x86_64-pc-linux-gnu-clang.cfg
/usr/lib/llvm/18
18.1.6
Python 3.12.3
Available Ruby profiles:
  (none found)
Available Rust versions:
  [1]   rust-bin-1.78.0 *
The following VMs are available for generation-2:
*)	Eclipse Temurin JDK 21.0.3_p9 [openjdk-bin-21]
Available Java Virtual Machines:
  [1]   openjdk-bin-21  system-vm

The Glorious Glasgow Haskell Compilation System, version 9.2.8
php cli (if any):
go version go1.22.3 linux/amd64

  HEAD of ::gentoo
commit da787dd38c88077ab3fbece4eb508b0dc63af0c0
Author: Repository mirror & CI <[e-mail]>
Date:   Wed Jun 5 02:34:07 2024 +0000

    2024-06-05 02:34:07 UTC

emerge -qpvO x11-base/xorg-server
[ebuild  N    ] x11-base/xorg-server-21.1.13-r1  USE="systemd udev xorg -debug (-elogind) -minimal (-selinux) -suid -test -unwind -xcsecurity -xephyr -xnest -xvfb"

[Comment 1 Toralf Förster 2024-06-05 08:04:15 UTC]

Created attachment 895137 [details]
emerge-info.txt

[Comment 2 Toralf Förster 2024-06-05 08:04:16 UTC]

Created attachment 895138 [details]
emerge-history.txt

[Comment 3 Toralf Förster 2024-06-05 08:04:17 UTC]

Created attachment 895139 [details]
environment

[Comment 4 Toralf Förster 2024-06-05 08:04:18 UTC]

Created attachment 895140 [details]
etc.clang.tar.xz

[Comment 5 Toralf Förster 2024-06-05 08:04:19 UTC]

Created attachment 895141 [details]
etc.portage.tar.xz

[Comment 6 Toralf Förster 2024-06-05 08:04:21 UTC]

Created attachment 895142 [details]
qlist-info.txt

[Comment 7 Toralf Förster 2024-06-05 08:04:23 UTC]

Created attachment 895143 [details]
temp.tar.xz

[Comment 8 Toralf Förster 2024-06-05 08:04:24 UTC]

Created attachment 895144 [details]
x11-base:xorg-server-21.1.13-r1:20240605-040629.log

[Comment 9 dwfreed 2024-07-21 08:08:19 UTC]

https://gitlab.freedesktop.org/xorg/lib/libxtrans/-/blob/3b3a3bd75d86aec78f6ef893b198c3efc378bc64/Xtrans.c#L1351

Same code for both this bug and bug 933659.  Xtrans is a "header"-only library that apparently just outright includes code too.  It is unclear where GCC's offsets come from, so this is potentially a false positive.  Equally, the code here is poorly written.  There's an upstream change after the most recent release that silences another GCC warning, but that isn't a good fix either:

https://gitlab.freedesktop.org/xorg/lib/libxtrans/-/commit/656d27ed32af4082e8062c1d7c42b65ea3a6b80f