Bug 337874

Summary:	net-misc/aget _FORTIFY_SOURCE indicates presence of overflow
Product:	Gentoo Linux	Reporter:	Diego Elio Pettenò (RETIRED) <flameeyes>
Component:	Current packages	Assignee:	Michael Weber (RETIRED) <xmw>
Status:	RESOLVED FIXED
Severity:	major	CC:	hardened
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	259417
Attachments:	Build log Patch to aget-0.4.1.ebuild to address reported overflow

Description Diego Elio Pettenò (RETIRED) gentoo-dev

2010-09-18 11:48:01 UTC

You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Thanks,
Your friendly neighborhood tinderboxer

Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev

2010-09-18 11:48:19 UTC

Created attachment 247787 [details]
Build log

Comment 2 Kevin Pyle 2010-09-18 18:02:13 UTC

Created attachment 247881 [details, diff]
Patch to aget-0.4.1.ebuild to address reported overflow

This patch makes several changes to the ebuild:

- Drop unnecessary assignment of DESTDIR.  Unset variables are empty by default, and Make does not warn about using an unset variable (unless you ask it to do so).  Besides which, the ebuild does not use the upstream 'install' target, so DESTDIR is never read.
- Drop inclusion of $CPPFLAGS into $CFLAGS.  The object files are built with an implicit rule that already respects $CPPFLAGS, so it does not need to be respecified.  I did toss in a -Wextra following the existing idea of enabling optional warnings.
- Rewrote build rule so that 'all' depends on 'aget' and 'aget' exists as a dedicated rule.  Without this, running make twice would keep rebuilding aget since the target 'all' is never created.
- Fixed the reported overflow.  For unknown reasons, upstream allocates a buffer of size GETREQSIZ - 2, then tells snprintf to use up to GETREQSIZ bytes.  Fix: drop the "- 2".
- Fixed useless memset.  It set 0 bytes to GETRECVSIZ, when it clearly meant to set GETRECVSIZ bytes to 0.

Comment 3 Michael Weber (RETIRED) gentoo-dev

2010-09-20 01:40:37 UTC

Ok, thanks for the patch, I'm gonna send this upstream .

Comment 4 Michael Weber (RETIRED) gentoo-dev

2010-09-20 04:09:52 UTC

+*aget-0.4.1-r1 (20 Sep 2010)
+
+  20 Sep 2010; Michael Weber <xmw@gentoo.org> +aget-0.4.1-r1.ebuild,
+  +files/aget-0.4.1-r1.patch:
+  Fix buffer overflow (bug #337874), thanks to Kevin Pyle.