Bug 336599 – media-video/spcaview _FORTIFY_SOURCE indicates presence of overflow

• Product: Gentoo Linux
• Status: RESOLVED WONTFIX

[Description Diego Elio Pettenò (RETIRED) 2010-09-09 14:43:51 UTC]

You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Thanks,
Your friendly neighborhood tinderboxer

P.S.: your proxied maintainer seem to not have a bugzilla account?

[Comment 1 Diego Elio Pettenò (RETIRED) 2010-09-09 14:44:01 UTC]

Created attachment 246597 [details]
Build log

[Comment 2 Kevin Pyle 2010-09-11 05:07:22 UTC]

Created attachment 246795 [details, diff]
Patch to increase size of buffer and to propagate length checking

The fortification error is triggered because the code declares char fourcc[4], then uses snprintf to write a fixed 4 character literal (plus null, so 5 total) into fourcc.  The code uses a hardcoded 5 to snprintf, presumably because using the proper size caused the data to be truncated.

This patch uses char fourcc[8], and adjusts the prototype of spcaGrab so that it can see the true size of the data passed to it.

I will also attach a trivial ebuild patch to apply this patch.

[Comment 3 Kevin Pyle 2010-09-11 05:07:56 UTC]

Created attachment 246797 [details, diff]
Patch to spcaview-20071224.ebuild to apply attachment #246795 [details, diff]

[Comment 4 Samuli Suominen (RETIRED) 2011-06-27 16:44:01 UTC]

The package is no longer in Portage, closing