You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.
Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.
By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.
Your friendly neighborhood tinderboxer
Created attachment 247787 [details]
Created attachment 247881 [details, diff]
Patch to aget-0.4.1.ebuild to address reported overflow
This patch makes several changes to the ebuild:
- Drop unnecessary assignment of DESTDIR. Unset variables are empty by default, and Make does not warn about using an unset variable (unless you ask it to do so). Besides which, the ebuild does not use the upstream 'install' target, so DESTDIR is never read.
- Drop inclusion of $CPPFLAGS into $CFLAGS. The object files are built with an implicit rule that already respects $CPPFLAGS, so it does not need to be respecified. I did toss in a -Wextra following the existing idea of enabling optional warnings.
- Rewrote build rule so that 'all' depends on 'aget' and 'aget' exists as a dedicated rule. Without this, running make twice would keep rebuilding aget since the target 'all' is never created.
- Fixed the reported overflow. For unknown reasons, upstream allocates a buffer of size GETREQSIZ - 2, then tells snprintf to use up to GETREQSIZ bytes. Fix: drop the "- 2".
- Fixed useless memset. It set 0 bytes to GETRECVSIZ, when it clearly meant to set GETRECVSIZ bytes to 0.
Ok, thanks for the patch, I'm gonna send this upstream .
+*aget-0.4.1-r1 (20 Sep 2010)
+ 20 Sep 2010; Michael Weber <email@example.com> +aget-0.4.1-r1.ebuild,
+ Fix buffer overflow (bug #337874), thanks to Kevin Pyle.