Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 337874 - net-misc/aget _FORTIFY_SOURCE indicates presence of overflow
Summary: net-misc/aget _FORTIFY_SOURCE indicates presence of overflow
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Michael Weber (RETIRED)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: fortify-source
  Show dependency tree
 
Reported: 2010-09-18 11:48 UTC by Diego Elio Pettenò (RETIRED)
Modified: 2010-09-20 04:09 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Build log (aget-0.4.1:20100918-043051.log,3.27 KB, text/plain)
2010-09-18 11:48 UTC, Diego Elio Pettenò (RETIRED)
Details
Patch to aget-0.4.1.ebuild to address reported overflow (aget-0.4.1.ebuild.patch,1.00 KB, patch)
2010-09-18 18:02 UTC, Kevin Pyle
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Diego Elio Pettenò (RETIRED) gentoo-dev 2010-09-18 11:48:01 UTC
You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Thanks,
Your friendly neighborhood tinderboxer
Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev 2010-09-18 11:48:19 UTC
Created attachment 247787 [details]
Build log
Comment 2 Kevin Pyle 2010-09-18 18:02:13 UTC
Created attachment 247881 [details, diff]
Patch to aget-0.4.1.ebuild to address reported overflow

This patch makes several changes to the ebuild:

- Drop unnecessary assignment of DESTDIR.  Unset variables are empty by default, and Make does not warn about using an unset variable (unless you ask it to do so).  Besides which, the ebuild does not use the upstream 'install' target, so DESTDIR is never read.
- Drop inclusion of $CPPFLAGS into $CFLAGS.  The object files are built with an implicit rule that already respects $CPPFLAGS, so it does not need to be respecified.  I did toss in a -Wextra following the existing idea of enabling optional warnings.
- Rewrote build rule so that 'all' depends on 'aget' and 'aget' exists as a dedicated rule.  Without this, running make twice would keep rebuilding aget since the target 'all' is never created.
- Fixed the reported overflow.  For unknown reasons, upstream allocates a buffer of size GETREQSIZ - 2, then tells snprintf to use up to GETREQSIZ bytes.  Fix: drop the "- 2".
- Fixed useless memset.  It set 0 bytes to GETRECVSIZ, when it clearly meant to set GETRECVSIZ bytes to 0.
Comment 3 Michael Weber (RETIRED) gentoo-dev 2010-09-20 01:40:37 UTC
Ok, thanks for the patch, I'm gonna send this upstream .
Comment 4 Michael Weber (RETIRED) gentoo-dev 2010-09-20 04:09:52 UTC
+*aget-0.4.1-r1 (20 Sep 2010)
+
+  20 Sep 2010; Michael Weber <xmw@gentoo.org> +aget-0.4.1-r1.ebuild,
+  +files/aget-0.4.1-r1.patch:
+  Fix buffer overflow (bug #337874), thanks to Kevin Pyle.