Menu

#6 GUI stack array overflow (off-by-one error)

stable
closed
Memphis
None
5
2018-10-10
2018-09-15
AW.
No

On modern Linux this bug causes abort with stack fortifier enabled. sprintf terminates 10-char string with '\0', and the array is 10 bytes long, causing overflow:

void paint_mem(GtkWidget widget, GdkEventExpose event, i8086core core, unsigned int startAdr)
{
char
memstr="", tmp;
char numstr[10];
[...]
sprintf(numstr, "\n%04x:%04x", CAST_TO_BASE((startAdr+(i
cols))/0x10000, 17), (i808616BitAdr)(CAST_TO_MEMSIZE(startAdr+(i*cols))));

1 Attachments

Discussion

  • Memphis

    Memphis - 2018-10-10
    • status: unread --> open-accepted
    • assigned_to: Memphis
     
  • Memphis

    Memphis - 2018-10-10
    • status: open-accepted --> closed
     
  • Memphis

    Memphis - 2018-10-10

    fixed in master - thx.

     

Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.