Package: aumix
Version: 2.8-21
Severity: normal
Tags: patch
User: [EMAIL PROTECTED]
Usertags: origin-ubuntu intrepid ubuntu-patch
Hello!
When running non-interactive, aumix does not use sane arguments when
calling strncpy, which is detected when compiling with -D_FORTIFY_SOURCE=2
(either directly or via the "hardening-wrapper" package).
Attached is the patch used in Ubuntu.
Thanks!
-Kees
--
Kees Cook @outflux.net
--- aumix-2.8.orig/src/common.c 2008-09-04 16:50:41.000000000 -0700
+++ aumix-2.8/src/common.c 2008-09-04 16:51:38.000000000 -0700
@@ -655,17 +655,18 @@
int SetShowNoninter(int dev)
{
/* Change or display settings from the command line. */
- char *devstr, dest;
+ char *devstr;
+ char dest[4];
int change = 0, tmp, left, right;
/* Increase or decrease levels, optionally by a number. */
if (!strncmp(optarg, "+", 1) || !strncmp(optarg, "-", 1)) {
ErrorExitWarn(ReadLevel(dev, &tmp), 'e');
right = tmp >> 8; /* I'll take the high byte, */
left = tmp & 0xFF; /* and you take the low byte. */
- strncpy(&dest, (optarg + 1), 3);
+ strncpy(dest, (optarg + 1), 3);
change = 1; /* For compatibility with versions 1.15 to 1.17, assume one if no number was given. */
- if (atoi(&dest))
- change = atoi(&dest);
+ if (atoi(dest))
+ change = atoi(dest);
if (*optarg == '+') { /* increase */
right += change;
left += change;
