Bug 340251

Summary:	net-analyzer/hping _FORTIFY_SOURCE indicates presence of overflow
Product:	Gentoo Linux	Reporter:	Diego Elio Pettenò (RETIRED) <flameeyes>
Component:	Current packages	Assignee:	Gentoo Netmon project <netmon>
Status:	RESOLVED FIXED
Severity:	major	CC:	hardened, jer
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	259417
Attachments:	Build log Patch to hping-3_pre20051105-r2.ebuild to address memcpy overflow

Description Diego Elio Pettenò (RETIRED) gentoo-dev

2010-10-09 12:15:17 UTC

You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Thanks,
Your friendly neighborhood tinderboxer

Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev

2010-10-09 12:15:38 UTC

Created attachment 250011 [details]
Build log

Comment 2 Kevin Pyle 2010-10-09 18:29:20 UTC

Created attachment 250043 [details, diff]
Patch to hping-3_pre20051105-r2.ebuild to address memcpy overflow

The value passed as sizeof() to the memcpy was unrelated to the value being filled by the memcpy, so the computed size was too big.  This patch adds a sed to rewrite the offending memcpy to use sizeof on the value receiving the data.

Comment 3 Jeroen Roovers (RETIRED) gentoo-dev

2010-11-30 21:31:16 UTC

Fixed in hping-3_pre20051105-r3.ebuild.