Bug 338936

Summary:	x11-misc/bbacpi _FORTIFY_SOURCE indicates presence of overflow
Product:	Gentoo Linux	Reporter:	Diego Elio Pettenò (RETIRED) <flameeyes>
Component:	Current packages	Assignee:	Desktop Misc. Team <desktop-misc>
Status:	RESOLVED FIXED
Severity:	major	CC:	hardened, treecleaner
Priority:	High	Keywords:	PMASKED
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	Pending Removal: 2012-12-24
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	259417
Attachments:	Build log Patch to bbacpi-0.1.5-r1.ebuild to address overflow, and other issues

Description Diego Elio Pettenò (RETIRED) gentoo-dev

2010-09-27 15:02:26 UTC

You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Thanks,
Your friendly neighborhood tinderboxer

Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev

2010-09-27 15:02:38 UTC

Created attachment 248798 [details]
Build log

Comment 2 Kevin Pyle 2010-09-28 03:08:19 UTC

Created attachment 248875 [details, diff]
Patch to bbacpi-0.1.5-r1.ebuild to address overflow, and other issues

This patch makes the following changes:

- Drop dependency on gtk+:2.  I can find no indication that any gtk+ headers are included.  The package does include libX11 headers, so libX11 is added to DEPEND.
- Fix configure check that appended -lX11 to $LDFLAGS instead of allowing the default handling that appended it to $LIBS.  As shipped, I could not compile this package with --as-needed.  I am uncertain why Diego was able to do so.  Perhaps his binutils is more lenient than mine (2.20.1-r1).  With -lX11 moved to $LIBS, I can compile this package.
- Drop unnecessary @CPPFLAGS@ in Makefile.am assignment.
- Delete very old 'missing' so that eautoreconf will add a new one.  The old one does not understand --run.
- Fix the overflow reported in comment #0 by converting all calls of fgets to use sizeof on their respective buffers.

Comment 3 Pacho Ramos gentoo-dev

2012-10-06 11:37:16 UTC

Thanks for the patch, but it still doesn't start for me due a missing font:
$ bbacpi 
blackbox: couldn't load default font.  please check to
make sure the necessary font is installed '-*-helvetica-medium-r-*-*-*-120-*-*-*-*-*-*'

Comment 4 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev

2012-11-25 10:15:17 UTC

+*bbacpi-0.1.5-r2 (25 Nov 2012)
+
+  25 Nov 2012; Kacper Kowalik <xarthisius@gentoo.org> +bbacpi-0.1.5-r2.ebuild,
+  +files/bbacpi-0.1.5-overflows.diff, bbacpi-0.1.5-r1.ebuild:
+  Fix buffer overflows wrt #338936 by Diego Elio Pettenò <flameeyes@gentoo.org>.
+  Thanks to Kevin Pyle for patch. Add missing dependency on helvetica font.
+  Thanks to James Cloos <cloos@jhcloos.com> for providing solution