Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 339898 - sci-visualization/spyview _FORTIFY_SOURCE indicates presence of overflow
Summary: sci-visualization/spyview _FORTIFY_SOURCE indicates presence of overflow
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Andreas K. Hüttel
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: fortify-source
  Show dependency tree
 
Reported: 2010-10-06 07:11 UTC by Diego Elio Pettenò (RETIRED)
Modified: 2011-04-24 21:54 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Build log (spyview-20100810:20101006-033248.log,78.76 KB, text/plain)
2010-10-06 07:12 UTC, Diego Elio Pettenò (RETIRED)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Diego Elio Pettenò (RETIRED) gentoo-dev 2010-10-06 07:11:48 UTC
You're receiving this bug because the package in Summary has produced _FORTIFY_SOURCE related warnings indicating the presence of a sure overflow in a static buffer.

Even though this is not always an indication of a security problem it might even be. So please check this out ASAP.

By the way, _FORTIFY_SOURCE is disabled when you disable optimisation, so don't try finding out the cause using -O0.

Thanks,
Your friendly neighborhood tinderboxer
Comment 1 Diego Elio Pettenò (RETIRED) gentoo-dev 2010-10-06 07:12:03 UTC
Created attachment 249708 [details]
Build log
Comment 2 Andreas K. Hüttel gentoo-dev 2010-10-10 20:47:22 UTC
Contacted author
Comment 3 Andreas K. Hüttel gentoo-dev 2010-10-31 21:27:11 UTC
The warning is 

In function ‘char* strncpy(char*, const char*, size_t)’,
    inlined from ‘void ImageWindow::exportLinecut()’ at ImageWindow.C:2053:33:
/usr/include/bits/string3.h:123:71: warning: call to char* 
__builtin___strncpy_chk(char*, const char*, unsigned int, unsigned int) will 
always overflow destination buffer
In function ‘char* strncpy(char*, const char*, size_t)’,
    inlined from ‘void ImageWindow::exportLinecut()’ at ImageWindow.C:2055:34:
/usr/include/bits/string3.h:123:71: warning: call to char* 
__builtin___strncpy_chk(char*, const char*, unsigned int, unsigned int) will 
always overflow destination buffer

and the corresponding code in ImageWindow.C is 

   2034 void ImageWindow::exportLinecut()
   2035 {
   2036   // Ok, this is a real hack, but it's easy...
   2037   char tmp[1024];
   2038   char label[1024];
   2039   char fn[1024];
   2040 
   2041   //sprintf is just so damn more convenient than c++ strings
   2042   if (line_cut_type == HORZLINE) 
   2043     snprintf(label, 1024, "l.%d", line_cut_yp);
   2044   else if (line_cut_type == VERTLINE) 
   2045     snprintf(label, 1024, "c.%d", line_cut_xp);
   2046   else 
   2047     sprintf(label, "other");
   2048   snprintf(fn, 1024, "%s.%s.linecut.dat", output_basename, label);
   2049         
   2050   info("exporting linecut to file %s\n", fn);
   2051 
   2052   strncpy(tmp, xsection_fn, 1024);
   2053   strncpy(xsection_fn, fn, 1024);      //<<<<<<<<<<<<<<<<<
   2054   plotLineCut();
   2055   strncpy(xsection_fn, tmp, 1024);  //<<<<<<<<<<<<<<<<<
   2056 }
Comment 4 Andreas K. Hüttel gentoo-dev 2011-04-03 15:37:10 UTC
Looking at the source made me suspect this was a false positive already long time ago. 

And voila, with current stable gcc the error message is gone.
Comment 5 Diego Elio Pettenò (RETIRED) gentoo-dev 2011-04-03 15:39:12 UTC
Define "Current stable gcc" because I think it is older than what produced this warning in the first place.

And also remember that "false positive" with these warnings is not any better, the code _will_ abort at runtime if it's reported.
Comment 6 Andreas K. Hüttel gentoo-dev 2011-04-03 17:28:46 UTC
(In reply to comment #5)
> Define "Current stable gcc" because I think it is older than what produced this
> warning in the first place.

x86_64-pc-linux-gnu-4.4.5
No reference in your build log which gcc was used, but you are correct, the warnings reappear with 4.5.2.

As a sidenote, some of the QA warnings appear only for LANG=C - that should probably be fixed.

> And also remember that "false positive" with these warnings is not any better,
> the code _will_ abort at runtime if it's reported.

Well, where should I go with that then?

I tried to contact you on IRC already loooong time ago to get a second opinion... as far as I know the code snippet in comment #3 together with the published definition of strncpy should be sufficient proof for a false positive, and it would be nice for some with more C knowledge to confirm this.
Comment 7 Diego Elio Pettenò (RETIRED) gentoo-dev 2011-04-03 18:58:43 UTC
I'm afraid you'd got to debug it by looking at the emitted assembly...

http://blog.flameeyes.eu/2010/09/12/some-_fortify_source-far-fetched-warnings-are-funny

This is an oldish post of mine that shows how I had to debug a similarly-surreal warning.
Comment 8 Andreas K. Hüttel gentoo-dev 2011-04-24 21:54:56 UTC
Fixed in spyview-20110329-r1 (yes it was a real buffer overflow, me stupid).