Your message dated Thu, 31 Oct 2024 13:45:46 +0000
with message-id <[email protected]>
and subject line Bug#781106: fixed in xjump 2.9.3-1
has caused the Debian Bug report #781106,
regarding xjump: Buffer overflow when building the highscores table
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
781106: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781106
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: xjump
Version: 2.7.5-6.1
Severity: normal
Tags: patch
Dear Maintainer,
The buffer that xjump uses to build the highscores table is too small. It only
allocates 43 characters per line but the lines actually consist of 45
characters.
This results in an overflow if the highscores table has the maximum number of
entries (the default maximum is 20).
To reproduce, compile xjump with the "-fsanitize=address" compiler option and
make it so the records file has the full 20 entries in it.
The address sanitizer should detect the overflow as soon as xjump launches,
when it attempts to display the current highscores.
I have attached a patch with a fix. It increases the size of the highscores
buffer and also replaces the calls to sprintf with safe calls to snprintf;
Better risk displaying an incomplete highscores table than overfow a buffer...
-- System Information:
Debian Release: 8.0
APT prefers testing-updates
APT policy: (500, 'testing-updates'), (500, 'testing-proposed-updates'),
(500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=pt_BR.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages xjump depends on:
ii libc6 2.19-15
ii libx11-6 2:1.6.2-3
ii libxaw7 2:1.0.12-2+b1
ii libxpm4 1:3.5.11-1+b1
ii libxt6 1:1.1.4-1+b1
xjump recommends no packages.
xjump suggests no packages.
-- no debconf information
diff -urpN xjump-2.7.5.orig/main.c xjump-2.7.5.patched/main.c
--- xjump-2.7.5.orig/main.c 2015-03-20 21:53:23.385830130 -0300
+++ xjump-2.7.5.patched/main.c 2015-03-20 22:40:51.261155723 -0300
@@ -58,7 +58,7 @@ static int GameMode; /* ¥â¡¼¥É (0¥¿¥¤¥È¥
static unsigned int Sc_now;
-static char Score_list[43*(RECORD_ENTRY+2)+1]=""; /* ¥Ï¥¤¥¹¥³¥¢¥Æ¥¥¹¥È */
+static char Score_list[45*(RECORD_ENTRY+2)+1]=""; /* ¥Ï¥¤¥¹¥³¥¢¥Æ¥¥¹¥È */
static XKeyboardState Keyboard; /* ¥¡¼¥Ü¡¼¥É¥¹¥Æ¡¼¥¿¥¹ */
static int Repeat_mode = 1; /* ¥¡¼¥ê¥Ô¡¼¥È¤Î¾õÂÖ(1:default 0:off) */
@@ -154,9 +154,17 @@ static void make_score( void )
p += sprintf( p,"RANK FLOOR NAME\n\
---- ---------- -------------------------------\n");
- for( i = 0 ; i < Record_entry ; i++ )
- p += sprintf( p,"%4d %10d %-20.20s\n",i+1,
+ for( i = 0 ; i < Record_entry ; i++ ){
+ size_t space_available = sizeof(Score_list) - (p-Score_list);
+ int nprinted = snprintf(p, space_available,"%4d %10d %-20.20s\n",i+1,
Record[i].score,Record[i].name );
+ if(nprinted <= space_available){
+ p += nprinted;
+ }else{
+ p += space_available;
+ break;
+ }
+ }
p--;
*p = '\0';
1234 1000 Someone-with-a-very-long-name
1233 1001 Someone-with-a-very-long-name
1232 1002 Someone-with-a-very-long-name
1231 1003 Someone-with-a-very-long-name
1230 1004 Someone-with-a-very-long-name
1229 1005 Someone-with-a-very-long-name
1228 1006 Someone-with-a-very-long-name
1227 1007 Someone-with-a-very-long-name
1226 1008 Someone-with-a-very-long-name
1225 1009 Someone-with-a-very-long-name
1224 1010 Someone-with-a-very-long-name
1223 1011 Someone-with-a-very-long-name
1222 1012 Someone-with-a-very-long-name
1221 1013 Someone-with-a-very-long-name
1220 1014 Someone-with-a-very-long-name
1219 1015 Someone-with-a-very-long-name
1218 1016 Someone-with-a-very-long-name
1217 1017 Someone-with-a-very-long-name
1216 1018 Someone-with-a-very-long-name
1215 1019 Someone-with-a-very-long-name
--- End Message ---
--- Begin Message ---
Source: xjump
Source-Version: 2.9.3-1
Done: Andreas Tille <[email protected]>
We believe that the bug you reported is fixed in the latest version of
xjump, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Tille <[email protected]> (supplier of updated xjump package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 21 Oct 2024 09:30:00 +0200
Source: xjump
Architecture: source
Version: 2.9.3-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Games Team <[email protected]>
Changed-By: Andreas Tille <[email protected]>
Closes: 352622 438301 680322 781106 958142 1075666 1081188 1082960
Changes:
xjump (2.9.3-1) unstable; urgency=medium
.
* Team upload.
Closes: #1082960
.
[ Andreas Tille ]
* New upstream version
Closes: #781106, #1075666, #352622, #680322, #438301
* Maintain package in Debian Games team
Closes: #1081188
* Add Homepage
* Add watch file
* Standards-Version: 4.7.0 (routine-update)
* debhelper-compat 13 (routine-update)
* Remove trailing whitespace in debian/changelog (routine-update)
* Remove trailing whitespace in debian/copyright (routine-update)
* Rules-Requires-Root: no (routine-update)
* Trim trailing whitespace.
* Remove deprecated Encoding key from desktop file debian/xjump.desktop.
* Remove constraints unnecessary since bullseye (oldstable):
+ Build-Depends: Replace dependency on transitional package
x11proto-core-dev with replacement x11proto-dev.
* d/rules: Short dh
* Remove debian/menu since there is a desktop file
* Remove unused prerm
* Enable hardening options
.
[ Helmut Grohne ]
* Fix FTCBFS: Let dh_auto_build pass cross tools to make.
Closes: #958142
Checksums-Sha1:
a0fb7815638baf5534d532c9ac315471d1fb73b4 1951 xjump_2.9.3-1.dsc
dc20122e90bbdc78127f69c6820dc5fb72fe760d 27302 xjump_2.9.3.orig.tar.gz
ba0befbc097da7ceaed4f31a64d957e5b0adf02c 5492 xjump_2.9.3-1.debian.tar.xz
3448a230cd960cafd397de201ea6ca5b167ef50d 6838 xjump_2.9.3-1_amd64.buildinfo
Checksums-Sha256:
b66a460669da7413a6f8522a38ec376837e27dd57e0a5c6566c7e404f95d1cb0 1951
xjump_2.9.3-1.dsc
8949d1f917f0b6f27383b05ea74e1c382b6b94bc416b59b87683d6ba64a77ca4 27302
xjump_2.9.3.orig.tar.gz
4bbb392e105966a41bcfc19ac2a9c94e68b16543d7cb793258717077978b4e39 5492
xjump_2.9.3-1.debian.tar.xz
248460711a8e4022dd9b45c130a761f5b6c4f014c7e9eb37f78d5e8ce8b0717f 6838
xjump_2.9.3-1_amd64.buildinfo
Files:
e783ad78ad05e6cbff2e0d02aa0123f8 1951 games optional xjump_2.9.3-1.dsc
c2393e7d34ca3110d75e08a847094f99 27302 games optional xjump_2.9.3.orig.tar.gz
9976d238fa4979eec2eec9d805c23f29 5492 games optional
xjump_2.9.3-1.debian.tar.xz
309e40816fb475214984680b2c32c9b9 6838 games optional
xjump_2.9.3-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmcWA1ERHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtFpNA/+P87jqRpUQDJTCqC+Fedyk9dXWhYQk/wc
H/N0uRC5wG0dXLAzEkY1fFsPDJFP1gILskEgqpdlUdzOBHqSLWbEyxw2Igia3CSv
RXpHO37wNPrgXCLTEAfUa3IB1OBpJo32cGsbgVo9jUZPb4XqrDCXwzH9VFEo1i7S
O/BfP/B6ZAgjYLeLONiISaFpiU84PPb3y7JjXvypoS8fN8lSdyQGH8Lu1JUVrV1w
GFtv3kSah6M7OxoSls2/UCdoreIdOZ7cUSeKa57wXApalKWwmp5/u8xKPEKBIqTF
jjSEeOwsclwqPJIMDffzSZ0od5gaSqRHmfJiQoT3PPS06CY1fp7xu/cPUVOOJMtv
R/DId7KOQQ2lYj27P1BaM8KS3Gx0GsJhjQx3xAb1hi7Ym4s+iAgo/QjqDaZPhst4
Btcstt0/J0a6SXz6YOOmIGWl9lVTnqn1tlc7svUdNTraQtQUadATzW29zobQWWGq
NYA3TtQ373/vGWZcb73aCxSIqwJp5BknDrkZ3iD7BGSMI5C2IY6SM0bTltvBf5lB
O7IE2tLYlsdP1dZM6MYmAt79LuZRaG9dD5PMkQLtWZrtbOmp7M4Iwk43jqSGGp1R
QlqlGUlQknTqpPzJbwZgah68mMzNJbMc4g2nSGfU/paWmtuW7Kt2Ezne2j8c2dTH
fMYIlXJJyKI=
=s+0k
-----END PGP SIGNATURE-----
pgp0YWGf5zWAB.pgp
Description: PGP signature
--- End Message ---
