Source: pftools Version: 3.2.12-3ubuntu1 Severity: normal Tags: patch X-Debbugs-Cc: [email protected] User: [email protected] Usertags: origin-ubuntu stonking ubuntu-patch
Hi, pfsearchV3 has a one-byte heap overflow in PrintTSV() (src/C/utils/output.c): char * ac = calloc(strlen(prf->AC_Number),sizeof(char)); strcpy(ac,prf->AC_Number); The buffer has no room for the ending NUL (the other output functions in the same file use 1+strlen()). It's visible with -D_FORTIFY_SOURCE=3, which Ubuntu uses by default: the TSV output test aborts with "*** buffer overflow detected ***" and the build fails. The attached patch fixes it; with it all 6 tests pass. It's still present in upstream master (v3.2.13). Ubuntu bug: https://bugs.launchpad.net/bugs/2170856 Thanks, Sebastien Bacher -- System Information: Debian Release: forky/sid APT prefers resolute-updates APT policy: (500, 'resolute-updates'), (500, 'resolute-security'), (500, 'resolute'), (100, 'resolute-backports') Architecture: amd64 (x86_64) Kernel: Linux 7.0.0-38-generic (SMP w/16 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled
Description: Fix heap buffer overflow in PrintTSV The buffer for the accession number is allocated without room for the ending NUL, so the following strcpy() writes one byte past the end. With _FORTIFY_SOURCE=3 this aborts pfsearchV3 -o 7 (TSV output). The other output functions already allocate 1+strlen(). Author: Sebastien Bacher <[email protected]> Bug-Ubuntu: https://bugs.launchpad.net/bugs/2170856 Forwarded: https://github.com/sib-swiss/pftools3/pull/33 Last-Update: 2026-10-15 Index: pftools-3.2.12/src/C/utils/output.c =================================================================== --- pftools-3.2.12.orig/src/C/utils/output.c +++ pftools-3.2.12/src/C/utils/output.c @@ -64,7 +64,7 @@ void PrintTSV(const struct Profile * con while ( *cptr != ';' && *cptr != '\0') ++cptr; *cptr = '\0'; - char * ac = calloc(strlen(prf->AC_Number),sizeof(char)); + char * ac = calloc(1+strlen(prf->AC_Number),sizeof(char)); strcpy(ac,prf->AC_Number); cptr = ac; while ( *cptr != ';' && *cptr != '\0' ) ++cptr;
