Your message dated Mon, 12 Oct 2026 07:37:10 +0000
with message-id <[email protected]>
and subject line Bug#1150624: fixed in fim 0.8.0-1
has caused the Debian Bug report #1150624,
regarding fim: FTBFS with buffer overflow in slurp_binary_fd() under
_FORTIFY_SOURCE=3
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150624: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150624
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: fim
Version: 0.7.1-5
Severity: important
Tags: patch
Dear Maintainer,
fim 0.7.1-5 fails to build from source under -D_FORTIFY_SOURCE=3 (e.g. in
Ubuntu 26.10).
The test suite aborts during 'make check' when running --script-from-stdin
tests:
*** buffer overflow detected ***: terminated
In src/common.cpp:slurp_binary_fd(), fim_realloc() reallocates the buffer to
(rb+=nrb)+1 bytes. On the next iteration, read() attempts to read inc (4096)
bytes into a buffer that has only 1 remaining byte, causing glibc's __read_chk
to abort.
This is fixed in upstream fim 0.8.0 by allocating (rb+=nrb)+inc+1 bytes and
ensuring NUL termination.
Ubuntu tracking bug: https://bugs.launchpad.net/ubuntu/+source/fim/+bug/2170358
The attached patch backports the upstream fix to 0.7.1-5.
Regards,
Viktor Pashaiev
Description: Fix buffer overflow in slurp_binary_fd() under _FORTIFY_SOURCE=3
In slurp_binary_fd(), fim_realloc shrunk the buffer down to rb+1 bytes after
reading the first chunk. On the subsequent iteration, read() attempts to read
inc (4096) bytes into a buffer that has only 1 remaining byte, causing
glibc's __read_chk (_FORTIFY_SOURCE=3) to abort with buffer overflow detected.
Backported from upstream fim 0.8.0.
Origin: backport, https://download.savannah.nongnu.org/releases/fbi-improved/fim-0.8.0.tar.gz
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/fim/+bug/2170358
Author: Viktor Pashaiev <[email protected]>
Last-Update: 2026-10-11
--- a/src/common.cpp
+++ b/src/common.cpp
@@ -379,12 +379,13 @@
fim_char_t *tb;
// if(nrb==inc) a full read. let's try again
// else we assume this is the last read (could not be true, of course)
- tb=(fim_char_t*)fim_realloc(buf,(rb+=nrb)+1);
+ tb=(fim_char_t*)fim_realloc(buf,(rb+=nrb)+inc+1);
if(tb!=FIM_NULL)
buf=tb;
else
{rb-=nrb;buf[rb]=FIM_SYM_CHAR_NUL;continue;}
}
+ if(buf) buf[rb]=FIM_SYM_CHAR_NUL;
if(rs)
*rs=rb;
ret:
--- End Message ---
--- Begin Message ---
Source: fim
Source-Version: 0.8.0-1
Done: Rafael Laboissière <[email protected]>
We believe that the bug you reported is fixed in the latest version of
fim, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Rafael Laboissière <[email protected]> (supplier of updated fim package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 12 Oct 2026 06:33:24 +0000
Source: fim
Architecture: source
Version: 0.8.0-1
Distribution: unstable
Urgency: medium
Maintainer: Michele Martone <[email protected]>
Changed-By: Rafael Laboissière <[email protected]>
Closes: 1150624
Changes:
fim (0.8.0-1) unstable; urgency=medium
.
* New upstream version 0.8.0
Closes: #1150624. Thanks to Viktor Pashaiev <[email protected]> for
reporting the issue.
* d/control:
+ Drop the redundant Priority field, which defaults to optional now
+ Bump Standards-Version to 4.7.4 (no changes needed)
+ Bump debhelper compatibility level to 14
+ Drop useless substitution variables ${*:Depends}
+ Build-depend on dh-sequence-single-binary
* Stop checking upstream tarball signature
+ d/watch: Drop Pgpsigurlmangle field
+ d/u/signing-key.asc: Drop file
* d/p/disable-readline-tests.patch: Refresh for new upstream version
* d/p/inkscape-export.patch: Refresh for new upstream version
* d/p/avoid-unaligned-integer-access.patch: Drop patch (applied upstream)
* d/copyright:
+ Use hyperlink instead of old FSF physical address
+ Reflect upstream changes
Checksums-Sha1:
32025fe323854a4b3969d1f948f37a4a2c97afd8 2285 fim_0.8.0-1.dsc
d237c34cf565e3c9a3bcded2f62b82abb56bd447 853370 fim_0.8.0.orig.tar.bz2
775a37c82026ac5f9bb256fb62ccb9d874ba3151 9788 fim_0.8.0-1.debian.tar.xz
Checksums-Sha256:
710f41b4d93bfb9f9ce0c767c737e14376a8102c52deef7fec6ff66b9928c36d 2285
fim_0.8.0-1.dsc
234d95406f76c28532a939c28d9308f8331a429b5adf735270f2fe2b45d06f0c 853370
fim_0.8.0.orig.tar.bz2
56025596e331b9584a027895e4529647ecf472498376cc585a15a4a0450ba09a 9788
fim_0.8.0-1.debian.tar.xz
Files:
087bf1f64ddc26a69b29c38f1653780b 2285 graphics optional fim_0.8.0-1.dsc
02e9c619ddc0fd25ba453dff4f1ea55f 853370 graphics optional
fim_0.8.0.orig.tar.bz2
2ea7605ec80ce284241cd7ab3ed91e52 9788 graphics optional
fim_0.8.0-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEP0ZDkUmP6HS9tdmPISSqGYN4XJAFAmrMiEMSHHJhZmFlbEBk
ZWJpYW4ub3JnAAoJECEkqhmDeFyQm0wP/0adrrAIf3KyVupOhaoLR18HGQs7c+Vi
hUfVbMKVugyfhegdIBNqm9YTFODebsDhkwaf2RqfChj5h8jKuasQJRgAuDoMYRoG
U1DZIyphF+/E2fpM9g5rmmy+u/4cPhNk4aPEg6NEFcS1ap3EEP516xwf5Vh58SjI
6eP3gXoqupeq7FsgX6q5uKU8SH/TsOY/IDyAHlgwDog/2u1NSOOokfsYdlyET6/f
MM79hZq6ZszsZK+nXAom5t3ZX8ImjfL7jXdbS39g812rWktAduZcywQPj4Ocbsu3
X+iWRfRjANaVIshuFXnK4NeOQgIWGwY75bBndz0usYIeguDUmj7SQoeqRPFMLtnh
k0paAh0nnK57J7/AaPD41QVecyEYFvvmqHjXEVw373gaY3wmiJDksQoyXTg27Z2B
A5s8mPw0KCtAl2tii61i66Tz46KQtxnSVFu6wLq5s9XWUe6pC7GatdVy0eGK2F9y
zaZ0/tqwIH8nDbHmJI7EW+e/AfOiwWVaXPrbPU0SJJDhK8FB6BT+24DiZKUfjsvo
5iE2aBruNwmxfwxsFKl/LtDFg4dLk8VB8W1QA3Nu9oMGSsvnVqFt1HLK0rxeNYrJ
BCoqOvKVbL055Pjh4Jl8BiydkZBXBa9qEgpLO2AsBiZU4giRqkWVDFdr6BistIfG
aHiUFPzNfV3s
=8PHz
-----END PGP SIGNATURE-----
pgpOHtQr098Cj.pgp
Description: PGP signature
--- End Message ---
