Bug 338936 – x11-misc/bbacpi _FORTIFY_SOURCE indicates presence of overflow

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Diego Elio Pettenò (RETIRED) 2010-09-27 15:02:26 UTC]

You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Thanks,
Your friendly neighborhood tinderboxer

[Comment 1 Diego Elio Pettenò (RETIRED) 2010-09-27 15:02:38 UTC]

Created attachment 248798 [details]
Build log

[Comment 2 Kevin Pyle 2010-09-28 03:08:19 UTC]

Created attachment 248875 [details, diff]
Patch to bbacpi-0.1.5-r1.ebuild to address overflow, and other issues

This patch makes the following changes:

- Drop dependency on gtk+:2.  I can find no indication that any gtk+ headers are included.  The package does include libX11 headers, so libX11 is added to DEPEND.
- Fix configure check that appended -lX11 to $LDFLAGS instead of allowing the default handling that appended it to $LIBS.  As shipped, I could not compile this package with --as-needed.  I am uncertain why Diego was able to do so.  Perhaps his binutils is more lenient than mine (2.20.1-r1).  With -lX11 moved to $LIBS, I can compile this package.
- Drop unnecessary @CPPFLAGS@ in Makefile.am assignment.
- Delete very old 'missing' so that eautoreconf will add a new one.  The old one does not understand --run.
- Fix the overflow reported in comment #0 by converting all calls of fgets to use sizeof on their respective buffers.

[Comment 3 Pacho Ramos 2012-10-06 11:37:16 UTC]

Thanks for the patch, but it still doesn't start for me due a missing font:
$ bbacpi 
blackbox: couldn't load default font.  please check to
make sure the necessary font is installed '-*-helvetica-medium-r-*-*-*-120-*-*-*-*-*-*'

[Comment 4 Kacper Kowalik (Xarthisius) (RETIRED) 2012-11-25 10:15:17 UTC]

+*bbacpi-0.1.5-r2 (25 Nov 2012)
+
+  25 Nov 2012; Kacper Kowalik <[e-mail]> +bbacpi-0.1.5-r2.ebuild,
+  +files/bbacpi-0.1.5-overflows.diff, bbacpi-0.1.5-r1.ebuild:
+  Fix buffer overflows wrt #338936 by Diego Elio Pettenò <[e-mail]>.
+  Thanks to Kevin Pyle for patch. Add missing dependency on helvetica font.
+  Thanks to James Cloos <[e-mail]> for providing solution