Package: bsdmainutils
Version: 9.0.12+nmu1

There is a buffer overflow in the column(1) command.
One way to trigger it is to give it 512KB of zeroes:

$ cat /dev/zero|head -c 524288 |column 
*** buffer overflow detected ***: column terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x3b50df9cbcb]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x3b50e025227]
/lib/x86_64-linux-gnu/libc.so.6(+0xf7360)[0x3b50e023360]
/lib/x86_64-linux-gnu/libc.so.6(__fgetws_chk+0x153)[0x3b50e0247c3]
column(+0x19c5)[0x4b09bfc9c5]
column(+0x1137)[0x4b09bfc137]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x3b50df4c2b1]
column(+0x11da)[0x4b09bfc1da]

This does not occur in some older (eg, Ubuntu 16.04's version
9.0.6ubuntu3) and newer (eg, Debian testing's 11.1.2) versions of
bsdmainutils, but it happens reliably in 9.0.12+nmu1 (Debian stable's
version).

Reply via email to