Package: fim Version: 0.7.1-5 Severity: important Tags: patch Dear Maintainer,
fim 0.7.1-5 fails to build from source under -D_FORTIFY_SOURCE=3 (e.g. in Ubuntu 26.10). The test suite aborts during 'make check' when running --script-from-stdin tests: *** buffer overflow detected ***: terminated In src/common.cpp:slurp_binary_fd(), fim_realloc() reallocates the buffer to (rb+=nrb)+1 bytes. On the next iteration, read() attempts to read inc (4096) bytes into a buffer that has only 1 remaining byte, causing glibc's __read_chk to abort. This is fixed in upstream fim 0.8.0 by allocating (rb+=nrb)+inc+1 bytes and ensuring NUL termination. Ubuntu tracking bug: https://bugs.launchpad.net/ubuntu/+source/fim/+bug/2170358 The attached patch backports the upstream fix to 0.7.1-5. Regards, Viktor Pashaiev
Description: Fix buffer overflow in slurp_binary_fd() under _FORTIFY_SOURCE=3 In slurp_binary_fd(), fim_realloc shrunk the buffer down to rb+1 bytes after reading the first chunk. On the subsequent iteration, read() attempts to read inc (4096) bytes into a buffer that has only 1 remaining byte, causing glibc's __read_chk (_FORTIFY_SOURCE=3) to abort with buffer overflow detected. Backported from upstream fim 0.8.0. Origin: backport, https://download.savannah.nongnu.org/releases/fbi-improved/fim-0.8.0.tar.gz Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/fim/+bug/2170358 Author: Viktor Pashaiev <[email protected]> Last-Update: 2026-10-11 --- a/src/common.cpp +++ b/src/common.cpp @@ -379,12 +379,13 @@ fim_char_t *tb; // if(nrb==inc) a full read. let's try again // else we assume this is the last read (could not be true, of course) - tb=(fim_char_t*)fim_realloc(buf,(rb+=nrb)+1); + tb=(fim_char_t*)fim_realloc(buf,(rb+=nrb)+inc+1); if(tb!=FIM_NULL) buf=tb; else {rb-=nrb;buf[rb]=FIM_SYM_CHAR_NUL;continue;} } + if(buf) buf[rb]=FIM_SYM_CHAR_NUL; if(rs) *rs=rb; ret:
