Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 338936

Summary: x11-misc/bbacpi _FORTIFY_SOURCE indicates presence of overflow
Product: Gentoo Linux Reporter: Diego Elio Pettenò (RETIRED) <flameeyes>
Component: Current packagesAssignee: Desktop Misc. Team <desktop-misc>
Severity: major CC: hardened, treecleaner
Priority: High Keywords: PMASKED
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: Pending Removal: 2012-12-24
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 259417    
Attachments: Build log
Patch to bbacpi-0.1.5-r1.ebuild to address overflow, and other issues

Description Diego Elio Pettenò (RETIRED) gentoo-dev 2010-09-27 15:02:26 UTC
You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Your friendly neighborhood tinderboxer
Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev 2010-09-27 15:02:38 UTC
Created attachment 248798 [details]
Build log
Comment 2 Kevin Pyle 2010-09-28 03:08:19 UTC
Created attachment 248875 [details, diff]
Patch to bbacpi-0.1.5-r1.ebuild to address overflow, and other issues

This patch makes the following changes:

- Drop dependency on gtk+:2.  I can find no indication that any gtk+ headers are included.  The package does include libX11 headers, so libX11 is added to DEPEND.
- Fix configure check that appended -lX11 to $LDFLAGS instead of allowing the default handling that appended it to $LIBS.  As shipped, I could not compile this package with --as-needed.  I am uncertain why Diego was able to do so.  Perhaps his binutils is more lenient than mine (2.20.1-r1).  With -lX11 moved to $LIBS, I can compile this package.
- Drop unnecessary @CPPFLAGS@ in assignment.
- Delete very old 'missing' so that eautoreconf will add a new one.  The old one does not understand --run.
- Fix the overflow reported in comment #0 by converting all calls of fgets to use sizeof on their respective buffers.
Comment 3 Pacho Ramos gentoo-dev 2012-10-06 11:37:16 UTC
Thanks for the patch, but it still doesn't start for me due a missing font:
$ bbacpi 
blackbox: couldn't load default font.  please check to
make sure the necessary font is installed '-*-helvetica-medium-r-*-*-*-120-*-*-*-*-*-*'
Comment 4 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev 2012-11-25 10:15:17 UTC
+*bbacpi-0.1.5-r2 (25 Nov 2012)
+  25 Nov 2012; Kacper Kowalik <> +bbacpi-0.1.5-r2.ebuild,
+  +files/bbacpi-0.1.5-overflows.diff, bbacpi-0.1.5-r1.ebuild:
+  Fix buffer overflows wrt #338936 by Diego Elio Pettenò <>.
+  Thanks to Kevin Pyle for patch. Add missing dependency on helvetica font.
+  Thanks to James Cloos <> for providing solution