Your message dated Mon, 23 Aug 2021 17:07:38 +0200 with message-id <[email protected]> and subject line Re: mingw-w64-i686-dev: non-conforming snprintf function in case of truncation has caused the Debian Bug report #948598, regarding CVE-2018-1000101 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 948598: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948598 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Source: mingw-w64 Severity: normal Tags: security Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000101 Cheers, Moritz
--- End Message ---
--- Begin Message ---Version: 8.0.0-1 On 2020-01-10 17:53:40 +0100, Vincent Lefevre wrote: > Package: mingw-w64-i686-dev > Version: 7.0.0-2 > Severity: normal > > Consider the following program: > > #include <stdio.h> > > int main (void) > { > char buf[8] = { 0 }; > int r; > > r = snprintf (buf, 3, "abcdef"); > printf ("r = %d, buf = \"%s\"\n", r, buf); > > return 0; > } > > When compiling with i686-w64-mingw32-gcc and running under Wine, > I get: > > r = -1, buf = "abc" > > which is incorrect. Adding the -posix option when compiling solves > the issue, i.e. I get > > r = 6, buf = "ab" > > but the snprintf function is not specific to POSIX. I could test that this was fixed in the current version (8.0.0-1). So, closing. Note: the upstream bug has been closed today, but the bug was actually fixed last year and the fix is included upstream in v8.0.0. Thanks to Pali Rohár for the fix and for the information. -- Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
--- End Message ---
