Your message dated Tue, 31 Dec 2013 17:33:22 +0000 with message-id <[email protected]> and subject line Bug#733650: fixed in readseq 1-11 has caused the Debian Bug report #733650, regarding readseq: Buffer overflow in ureadseq.c to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 733650: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733650 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: readseq Version: 1-10 Severity: normal Tags: patch Hello, looking at why readseq failed to build in Ubuntu trusty, gcc found a buffer overflow in ureadseq.c: In function 'strcpy', inlined from 'writeSeq' at ureadseq.c:1925:13: /usr/include/x86_64-linux-gnu/bits/string3.h:104:3: warning: call to __builtin___memcpy_chk will always overflow destination buffer [enabled by default] which then got triggered by the test suite: Test of NCBI ASN.1 conversions: ./readseq -p -f=asn test.m-ig -otest.m-asn *** buffer overflow detected ***: ./readseq terminated Looking at ureadseq.c:writeSeq() it's pretty obvious that char idword[31], endstr[10]; (line 1771) and strcpy(endstr,"\"\n } } ,"); (line 1925) won't match (the string copied is 14 bytes long). Regards, MichaelIndex: readseq-1/ureadseq.c =================================================================== --- readseq-1.orig/ureadseq.c 2013-12-30 18:06:59.000000000 +0100 +++ readseq-1/ureadseq.c 2013-12-30 18:13:37.000000000 +0100 @@ -1768,7 +1768,7 @@ short linesout = 0, seqtype = kNucleic; long i, j, l, l1, ibase; - char idword[31], endstr[10]; + char idword[31], endstr[14]; char seqnamestore[128], *seqname = seqnamestore; char s[kMaxseqwidth], *cp; char nameform[10], numform[10], nocountsymbols[10];
--- End Message ---
--- Begin Message ---Source: readseq Source-Version: 1-11 We believe that the bug you reported is fixed in the latest version of readseq, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Andreas Tille <[email protected]> (supplier of updated readseq package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Tue, 31 Dec 2013 15:38:41 +0100 Source: readseq Binary: readseq Architecture: source amd64 Version: 1-11 Distribution: unstable Urgency: medium Maintainer: Debian Med Packaging Team <[email protected]> Changed-By: Andreas Tille <[email protected]> Description: readseq - Conversion between sequence formats Closes: 733650 Changes: readseq (1-11) unstable; urgency=medium . * debian/patches/buffer_overflow.patch: Fix buffer overflow (thanks to Michael Bienia <[email protected]> for the patch) Closes: #733650 Checksums-Sha1: 869d7dba5e99de56d6b765ba8c2429f75c01a481 1310 readseq_1-11.dsc b3c66750f0d1994b8e9b677613c6cf8ec721fea5 18708 readseq_1-11.debian.tar.gz 6c5d6d54b65da69abefd91a925e6d143e8481e1a 54460 readseq_1-11_amd64.deb Checksums-Sha256: 6abe5c383b589a82eaa8597bca516c29fa4bb21193af2085b8320220d49edad2 1310 readseq_1-11.dsc 12fc30ab84b9f37afacb236c648c883c97b447f99f41f2199ef6dcc795f3cc3f 18708 readseq_1-11.debian.tar.gz e7cae77c832652028bd3ab1761fe8e6772ea10bff6ed603d40cdd11f630d35b2 54460 readseq_1-11_amd64.deb Files: 71ba70da909b1bd78cfba004afa3cff5 1310 science optional readseq_1-11.dsc 2a16713d08018c6e50b51e86e5484697 18708 science optional readseq_1-11.debian.tar.gz 28c8e1f7d9dabd9947ea2e9260d82c07 54460 science optional readseq_1-11_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iEYEARECAAYFAlLC/qgACgkQYDBbMcCf01qrKgCffbAEvcPINk9V4iA08jsQvdhV yP8AoI4j/wPBSH3AU5Ur4Y3oEJ3nvqdT =k2L3 -----END PGP SIGNATURE-----
--- End Message ---
