Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 338936 - x11-misc/bbacpi _FORTIFY_SOURCE indicates presence of overflow
Summary: x11-misc/bbacpi _FORTIFY_SOURCE indicates presence of overflow
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Desktop Misc. Team
Whiteboard: Pending Removal: 2012-12-24
Keywords: PMASKED
Depends on:
Blocks: fortify-source
  Show dependency tree
Reported: 2010-09-27 15:02 UTC by Diego Elio Pettenò (RETIRED)
Modified: 2012-11-25 10:15 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Build log (bbacpi-0.1.5-r1:20100927-144116.log,36.73 KB, text/plain)
2010-09-27 15:02 UTC, Diego Elio Pettenò (RETIRED)
Patch to bbacpi-0.1.5-r1.ebuild to address overflow, and other issues (bbacpi-0.1.5-r1.ebuild.patch,986 bytes, patch)
2010-09-28 03:08 UTC, Kevin Pyle
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Diego Elio Pettenò (RETIRED) gentoo-dev 2010-09-27 15:02:26 UTC
You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Your friendly neighborhood tinderboxer
Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev 2010-09-27 15:02:38 UTC
Created attachment 248798 [details]
Build log
Comment 2 Kevin Pyle 2010-09-28 03:08:19 UTC
Created attachment 248875 [details, diff]
Patch to bbacpi-0.1.5-r1.ebuild to address overflow, and other issues

This patch makes the following changes:

- Drop dependency on gtk+:2.  I can find no indication that any gtk+ headers are included.  The package does include libX11 headers, so libX11 is added to DEPEND.
- Fix configure check that appended -lX11 to $LDFLAGS instead of allowing the default handling that appended it to $LIBS.  As shipped, I could not compile this package with --as-needed.  I am uncertain why Diego was able to do so.  Perhaps his binutils is more lenient than mine (2.20.1-r1).  With -lX11 moved to $LIBS, I can compile this package.
- Drop unnecessary @CPPFLAGS@ in assignment.
- Delete very old 'missing' so that eautoreconf will add a new one.  The old one does not understand --run.
- Fix the overflow reported in comment #0 by converting all calls of fgets to use sizeof on their respective buffers.
Comment 3 Pacho Ramos gentoo-dev 2012-10-06 11:37:16 UTC
Thanks for the patch, but it still doesn't start for me due a missing font:
$ bbacpi 
blackbox: couldn't load default font.  please check to
make sure the necessary font is installed '-*-helvetica-medium-r-*-*-*-120-*-*-*-*-*-*'
Comment 4 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev 2012-11-25 10:15:17 UTC
+*bbacpi-0.1.5-r2 (25 Nov 2012)
+  25 Nov 2012; Kacper Kowalik <> +bbacpi-0.1.5-r2.ebuild,
+  +files/bbacpi-0.1.5-overflows.diff, bbacpi-0.1.5-r1.ebuild:
+  Fix buffer overflows wrt #338936 by Diego Elio Pettenò <>.
+  Thanks to Kevin Pyle for patch. Add missing dependency on helvetica font.
+  Thanks to James Cloos <> for providing solution