Menu

#2 buffer overflow detected

v1.0 (example)
open
nobody
None
5
2013-05-07
2013-03-26
No

Hallo, there are problems with gabedit when parsing files, gamess output.
The result is a buffer overflow.
The problem is with AnimationGeomConv ~line 1444
sprintf(listOfAtoms[j].symbol,"%s",AtomCoord[0]);
sprintf(listOfAtoms[j].mmType,"%s",AtomCoord[0]);
sprintf(listOfAtoms[j].pdbType,"%s",AtomCoord[0]);
length of buffers symbol mmType and pdbType
is 5 but AtomCoord can be larger when reading e.g.
gamess or nwchem.
Fixes:
1. make names larger
2. truncate AtomCoord to available space, 4 currently
Why using sprintf? This is inefficient and unsafe.
my proposal:
/* sprintf(listOfAtoms[j].symbol,"%s",AtomCoord[0]); */
/* sprintf(listOfAtoms[j].mmType,"%s",AtomCoord[0]); */
/* sprintf(listOfAtoms[j].pdbType,"%s",AtomCoord[0]); */
g_strlcpy(listOfAtoms[j].symbol,AtomCoord[0],5);
g_strlcpy(listOfAtoms[j].mmType,AtomCoord[0],5);
g_strlcpy(listOfAtoms[j].pdbType,AtomCoord[0],5);
g_strlcpy is like strlcpy but available in glib.

When this is fixed, a minor problem emerges, atom types are associated in code like gamess
with atomic number, in the second column, the name being related exclusively to output appearance.
Otherwise atoms may not be recognized.

Discussion

  • Allouche Abdul-Rahman

    • Group: --> v1.0 (example)
     
  • Allouche Abdul-Rahman

    Yes this is a bug.
    It can be fixe by adding :

    sprintf(AtomCoord[0],get_symbol_using_z(atoi(dum)));

    before
    sprintf(listOfAtoms[j].symbol,"%s",AtomCoord[0]);

    This bug will be fixed in the next version of Gabedit.