Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 297896 - app-backup/bacula 2.4.1-r1 + gcc-4.3.3 - reports a false buffer overflow in glibc in cause of builded with FORTIFY_SOURCE on
Summary: app-backup/bacula 2.4.1-r1 + gcc-4.3.3 - reports a false buffer overflow in g...
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: AMD64 Linux
: High normal (vote)
Assignee: App-Backup Team
URL: http://bugs.bacula.org/view.php?id=1220
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-12-22 13:40 UTC by deadeyes
Modified: 2010-11-02 22:28 UTC (History)
10 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
bacula-2.4.1-r1.ebuild (bacula-2.4.1-r1.ebuild,15.46 KB, text/plain)
2010-06-14 17:51 UTC, Ortwin Glueck
Details

Note You need to log in before you can comment on or make changes to this bug.
Description deadeyes 2009-12-22 13:40:50 UTC
Note that this is a bug as stated in #257016
BUT! This is not fixed in the 2.4.1-r1 ebuild (and 2.4.1-r1 is stable)
Also, this bug has not been fixed there either: http://bugs.gentoo.org/show_bug.cgi?id=280048
In the patch applied there, python2.6 is only added in one place.
It should be in two locations. (see attachment http://bugs.gentoo.org/attachment.cgi?id=209343)

Sorry to clone this bug for it, but I couldn't reopen the bug.

+++ This bug was initially created as a clone of Bug #257016 +++

Hi,

I opened a bug into the bacula bug tracking system and got the answer that the source has to been build without FORTIFY_SOURCE turned on. To solve the issue that builded bacula versions with gcc 4.3.3 detects a false buffer overflow. The complete thread is appended as additional information.

Here the direct link to the bug also with emerge info: http://bugs.bacula.org/view.php?id=1220


Best Regards
Martin

Reproducible: Always




The following issue has been CLOSED 
====================================================================== 
http://bugs.bacula.org/view.php?id=1220 
====================================================================== 
Reported By:                mrbscreen
Assigned To:                kern
====================================================================== 
Project:                    bacula
Issue ID:                   1220
Category:                   bat
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     closed
Resolution:                 not a bug
Fixed in Version:           
====================================================================== 
Date Submitted:             2009-01-30 06:53 UTC
Last Modified:              2009-01-30 08:04 UTC
====================================================================== 
Summary:                    compile bacula with gcc 4.3.3 doesnot work
Description: 
Dear Sear or Madame,

yesterday I updated gcc from version 4.3.2 to version 4.3.3 on my gentoo
system. After that I updated bacula to version 2.4.4 the build was without
errors but if I start the any program a "buffer overflow" detection of
glibc occurs (see additional information). I downgraded to version 2.4.1
and the same thing happens. After downgrade the C Compiler to version 4.3.2
bacula works well also in version 2.4.4. The error occurs also in bconsole
etc.

Best Regards,
Martin Bauer
====================================================================== 

---------------------------------------------------------------------- 
 (0003901) mrbscreen (reporter) - 2009-01-30 06:55
 http://bugs.bacula.org/view.php?id=1220#c3901 
---------------------------------------------------------------------- 
Note that the "emerge --info" is from the working set. If it is helpfully I
can do one with gcc 4.3.2

 

---------------------------------------------------------------------- 
 (0003902) kern (administrator) - 2009-01-30 08:04
 http://bugs.bacula.org/view.php?id=1220#c3902 
---------------------------------------------------------------------- 
You are not building Bacula with the Bacula makefiles, and consequently,
you (or you packaging tool) are adding the -DFORTIFY_SOURCE option, which
is broken.  This creates a false buffer overflow detection by glibc.  You
need to build without FORTIFY_SOURCE turned on. 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2009-01-30 06:53 mrbscreen      New Issue                                    
2009-01-30 06:53 mrbscreen      Status                   new => assigned     
2009-01-30 06:53 mrbscreen      Assigned To               => dbartley        
2009-01-30 06:55 mrbscreen      Note Added: 0003901                          
2009-01-30 06:55 mrbscreen      Issue Monitored: mrbscreen                    
2009-01-30 06:55 mrbscreen      Note Edited: 0003901                         
2009-01-30 08:04 kern           Note Added: 0003902                          
2009-01-30 08:04 kern           Assigned To              dbartley => kern    
2009-01-30 08:04 kern           Status                   assigned => closed  
2009-01-30 08:04 kern           Resolution               open => not a bug   
2009-01-30 08:04 kern           Steps to Reproduce Updated                    
======================================================================
Comment 1 Wolfram Schlich (RETIRED) gentoo-dev 2010-01-27 14:16:20 UTC
So you say it's not fixed in 3.0.3?

I don't care about 2.4.x anymore, 5.0.0 has been released and will be
in the tree shortly.
Comment 2 deadeyes 2010-01-29 09:01:16 UTC
(In reply to comment #1)
> So you say it's not fixed in 3.0.3?
> 
> I don't care about 2.4.x anymore, 5.0.0 has been released and will be
> in the tree shortly.
> 

Well, some people still use this.
It is a rather easy patch so I dont see why it wouldnt be included
Comment 3 Bjorn Fahller 2010-02-14 11:42:55 UTC
(In reply to comment #1)
> So you say it's not fixed in 3.0.3?
> 
> I don't care about 2.4.x anymore, 5.0.0 has been released and will be
> in the tree shortly.
> 

I am more than slightly troubled by the idea that it's OK for the stable version to be completely broken. I am also quite troubled by the suggestion to use an unstable backup system. If 3.0.3 is good, stabelize it, please.
Comment 4 Wolfram Schlich (RETIRED) gentoo-dev 2010-03-23 10:14:18 UTC
5.0.1-r2 is in the tree. Please test this version :)
Comment 5 deadeyes 2010-03-24 17:37:18 UTC
(In reply to comment #4)
> 5.0.1-r2 is in the tree. Please test this version :)
> 

We need stable... not testing
Comment 6 Wolfram Schlich (RETIRED) gentoo-dev 2010-03-26 10:10:01 UTC
Then you'll have to wait until 5.0.1 gets stabled -OR- someone
else fixes the old stuff.
Comment 7 deadeyes 2010-03-26 12:59:31 UTC
(In reply to comment #6)
> Then you'll have to wait until 5.0.1 gets stabled -OR- someone
> else fixes the old stuff.
> 

What I mean is that the fix for this is already available but just should be included which IMHO is done quickly.
Comment 8 Ortwin Glueck 2010-06-14 17:50:29 UTC
I am very happy that finally someone has taken over maintainership of bacula again. However, it's moronic to just ignore trivial patches that make current "stable" actually build.

Meanwhile put the attached ebuild into your local overlay.
Comment 9 Ortwin Glueck 2010-06-14 17:51:06 UTC
Created attachment 235297 [details]
bacula-2.4.1-r1.ebuild
Comment 10 Thomas Beierlein gentoo-dev 2010-11-02 22:28:51 UTC
As 5.0.2 or 5.0.3 are stable now for all arches I see no reason to keep these bug open.  

Be aware that 2.4.1 and 3.0.3 will be dropped from the tree in next days. So please migrate to the newer versions, in case you have not done so yet.