#217 buffer overrun in irrecord

[erroneous_1]

Environment: Arch Linux with Linux 4.7.0-1-ARCH x86_64 kernel, glibc 2.24 commit fdfc9260. lirc-0.9.4a
Trying to run irrecord on a devinput device produced the following error:

...
Enter name of remote (only ascii, no spaces) :HarmonyMCE
Using HarmonyMCE.lircd.conf as output filename

*** buffer overflow detected ***: /home/data/packages/lirc/src/lirc-0.9.4a/tools/.libs/lt-irrecord terminated
======= Backtrace: =========
/usr/lib/libc.so.6(+0x70c4b)[0x7ffff7472c4b]
/usr/lib/libc.so.6(__fortify_fail+0x37)[0x7ffff74faf17]
/usr/lib/libc.so.6(+0xf7050)[0x7ffff74f9050]
/usr/lib/libc.so.6(+0xf74bd)[0x7ffff74f94bd]
/home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/libirrecord.so.0(flushhw+0x63)[0x7ffff77a26f3]
/home/data/packages/lirc/src/lirc-0.9.4a/tools/.libs/lt-irrecord(+0x4492)[0x555555558492]
/home/data/packages/lirc/src/lirc-0.9.4a/tools/.libs/lt-irrecord(+0x2c36)[0x555555556c36]
/usr/lib/libc.so.6(__libc_start_main+0xf1)[0x7ffff7422291]
/home/data/packages/lirc/src/lirc-0.9.4a/tools/.libs/lt-irrecord(+0x34ea)[0x5555555574ea]
======= Memory map: ========
555555554000-55555555b000 r-xp 00000000 08:02 1077786                    /home/data/packages/lirc/src/lirc-0.9.4a/tools/.libs/lt-irrecord
55555575b000-55555575c000 r--p 00007000 08:02 1077786                    /home/data/packages/lirc/src/lirc-0.9.4a/tools/.libs/lt-irrecord
55555575c000-55555575d000 rw-p 00008000 08:02 1077786                    /home/data/packages/lirc/src/lirc-0.9.4a/tools/.libs/lt-irrecord
55555575d000-55555577e000 rw-p 00000000 00:00 0                          [heap]
7ffff5c66000-7ffff5c7c000 r-xp 00000000 08:02 6294973                    /usr/lib/libgcc_s.so.1
7ffff5c7c000-7ffff5e7b000 ---p 00016000 08:02 6294973                    /usr/lib/libgcc_s.so.1
7ffff5e7b000-7ffff5e7c000 r--p 00015000 08:02 6294973                    /usr/lib/libgcc_s.so.1
7ffff5e7c000-7ffff5e7d000 rw-p 00016000 08:02 6294973                    /usr/lib/libgcc_s.so.1
7ffff5e7d000-7ffff5f80000 r-xp 00000000 08:02 6294838                    /usr/lib/libm-2.24.so
7ffff5f80000-7ffff617f000 ---p 00103000 08:02 6294838                    /usr/lib/libm-2.24.so
7ffff617f000-7ffff6180000 r--p 00102000 08:02 6294838                    /usr/lib/libm-2.24.so
7ffff6180000-7ffff6181000 rw-p 00103000 08:02 6294838                    /usr/lib/libm-2.24.so
7ffff6181000-7ffff6195000 r-xp 00000000 08:02 6294840                    /usr/lib/libresolv-2.24.so
7ffff6195000-7ffff6394000 ---p 00014000 08:02 6294840                    /usr/lib/libresolv-2.24.so
7ffff6394000-7ffff6395000 r--p 00013000 08:02 6294840                    /usr/lib/libresolv-2.24.so
7ffff6395000-7ffff6396000 rw-p 00014000 08:02 6294840                    /usr/lib/libresolv-2.24.so
7ffff6396000-7ffff6398000 rw-p 00000000 00:00 0 
7ffff6398000-7ffff639f000 r-xp 00000000 08:02 6294841                    /usr/lib/librt-2.24.so
7ffff639f000-7ffff659e000 ---p 00007000 08:02 6294841                    /usr/lib/librt-2.24.so
7ffff659e000-7ffff659f000 r--p 00006000 08:02 6294841                    /usr/lib/librt-2.24.so
7ffff659f000-7ffff65a0000 rw-p 00007000 08:02 6294841                    /usr/lib/librt-2.24.so
7ffff67aa000-7ffff67b9000 r-xp 00000000 08:02 1078425                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc_driver.so.0.0.0
7ffff67b9000-7ffff69b8000 ---p 0000f000 08:02 1078425                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc_driver.so.0.0.0
7ffff69b8000-7ffff69b9000 r--p 0000e000 08:02 1078425                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc_driver.so.0.0.0
7ffff69b9000-7ffff69ba000 rw-p 0000f000 08:02 1078425                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc_driver.so.0.0.0
7ffff69ba000-7ffff69bb000 rw-p 00000000 00:00 0 
7ffff69bb000-7ffff69d3000 r-xp 00000000 08:02 6294705                    /usr/lib/libpthread-2.24.so
7ffff69d3000-7ffff6bd2000 ---p 00018000 08:02 6294705                    /usr/lib/libpthread-2.24.so
7ffff6bd2000-7ffff6bd3000 r--p 00017000 08:02 6294705                    /usr/lib/libpthread-2.24.so
7ffff6bd3000-7ffff6bd4000 rw-p 00018000 08:02 6294705                    /usr/lib/libpthread-2.24.so
7ffff6bd4000-7ffff6bd8000 rw-p 00000000 00:00 0 
7ffff6be2000-7ffff6be6000 r-xp 00000000 08:02 6301661                    /usr/lib/libcap.so.2.25
7ffff6be6000-7ffff6de5000 ---p 00004000 08:02 6301661                    /usr/lib/libcap.so.2.25
7ffff6de5000-7ffff6de6000 rw-p 00003000 08:02 6301661                    /usr/lib/libcap.so.2.25
7ffff6de6000-7ffff6dea000 r-xp 00000000 08:02 6312074                    /usr/lib/lirc/plugins/devinput.so
7ffff6dea000-7ffff6fe9000 ---p 00004000 08:02 6312074                    /usr/lib/lirc/plugins/devinput.so
7ffff6fe9000-7ffff6fea000 r--p 00003000 08:02 6312074                    /usr/lib/lirc/plugins/devinput.so
7ffff6fea000-7ffff6feb000 rw-p 00004000 08:02 6312074                    /usr/lib/lirc/plugins/devinput.so
7ffff6feb000-7ffff6fec000 rw-p 00000000 00:00 0 
7ffff6fec000-7ffff6ff6000 r-xp 00000000 08:02 6294832                    /usr/lib/libnss_files-2.24.so
7ffff6ff6000-7ffff71f6000 ---p 0000a000 08:02 6294832                    /usr/lib/libnss_files-2.24.so
7ffff71f6000-7ffff71f7000 r--p 0000a000 08:02 6294832                    /usr/lib/libnss_files-2.24.so
7ffff71f7000-7ffff71f8000 rw-p 0000b000 08:02 6294832                    /usr/lib/libnss_files-2.24.so
7ffff71f8000-7ffff71fe000 rw-p 00000000 00:00 0 
7ffff71fe000-7ffff7200000 r-xp 00000000 08:02 6294837                    /usr/lib/libdl-2.24.so
7ffff7200000-7ffff7400000 ---p 00002000 08:02 6294837                    /usr/lib/libdl-2.24.so
7ffff7400000-7ffff7401000 r--p 00002000 08:02 6294837                    /usr/lib/libdl-2.24.so
7ffff7401000-7ffff7402000 rw-p 00003000 08:02 6294837                    /usr/lib/libdl-2.24.so
7ffff7402000-7ffff7597000 r-xp 00000000 08:02 6294745                    /usr/lib/libc-2.24.so
7ffff7597000-7ffff7796000 ---p 00195000 08:02 6294745                    /usr/lib/libc-2.24.so
7ffff7796000-7ffff779a000 r--p 00194000 08:02 6294745                    /usr/lib/libc-2.24.so
7ffff779a000-7ffff779c000 rw-p 00198000 08:02 6294745                    /usr/lib/libc-2.24.so
7ffff779c000-7ffff77a0000 rw-p 00000000 00:00 0 
7ffff77a0000-7ffff77a8000 r-xp 00000000 08:02 1078480                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/libirrecord.so.0.0.0
7ffff77a8000-7ffff79a8000 ---p 00008000 08:02 1078480                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/libirrecord.so.0.0.0
7ffff79a8000-7ffff79a9000 r--p 00008000 08:02 1078480                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/libirrecord.so.0.0.0
7ffff79a9000-7ffff79aa000 rw-p 00009000 08:02 1078480                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/libirrecord.so.0.0.0
7ffff79aa000-7ffff79ca000 r-xp 00000000 08:02 1078461                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc.so.0.0.0
7ffff79ca000-7ffff7bca000 ---p 00020000 08:02 1078461                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc.so.0.0.0
7ffff7bca000-7ffff7bcb000 r--p 00020000 08:02 1078461                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc.so.0.0.0
7ffff7bcb000-7ffff7bce000 rw-p 00021000 08:02 1078461                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc.so.0.0.0
7ffff7bce000-7ffff7bd0000 rw-p 00000000 00:00 0 
7ffff7bd0000-7ffff7bd9000 r-xp 00000000 08:02 1078421                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc_client.so.0.4.0
7ffff7bd9000-7ffff7dd8000 ---p 00009000 08:02 1078421                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc_client.so.0.4.0
7ffff7dd8000-7ffff7dd9000 r--p 00008000 08:02 1078421                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc_client.so.0.4.0
7ffff7dd9000-7ffff7dda000 rw-p 00009000 08:02 1078421                    /home/data/packages/lirc/src/lirc-0.9.4a/lib/.libs/liblirc_client.so.0.4.0
7ffff7dda000-7ffff7dfd000 r-xp 00000000 08:02 6294744                    /usr/lib/ld-2.24.so
7ffff7fac000-7ffff7fca000 r-xp 00000000 08:02 6346298                    /usr/lib/libudev.so.1.6.5
7ffff7fca000-7ffff7fcb000 ---p 0001e000 08:02 6346298                    /usr/lib/libudev.so.1.6.5
7ffff7fcb000-7ffff7fcc000 r--p 0001e000 08:02 6346298                    /usr/lib/libudev.so.1.6.5
7ffff7fcc000-7ffff7fcd000 rw-p 0001f000 08:02 6346298                    /usr/lib/libudev.so.1.6.5
7ffff7fcd000-7ffff7fcf000 rw-p 00000000 00:00 0 
7ffff7ff5000-7ffff7ff8000 rw-p 00000000 00:00 0 
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0                          [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0                          [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00022000 08:02 6294744                    /usr/lib/ld-2.24.so
7ffff7ffd000-7ffff7ffe000 rw-p 00023000 08:02 6294744                    /usr/lib/ld-2.24.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

Program received signal SIGABRT, Aborted.
0x00007ffff743504f in raise () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff743504f in raise () from /usr/lib/libc.so.6
#1  0x00007ffff743647a in abort () from /usr/lib/libc.so.6
#2  0x00007ffff7472c50 in __libc_message () from /usr/lib/libc.so.6
#3  0x00007ffff74faf17 in __fortify_fail () from /usr/lib/libc.so.6
#4  0x00007ffff74f9050 in __chk_fail () from /usr/lib/libc.so.6
#5  0x00007ffff74f94bd in __read_chk () from /usr/lib/libc.so.6
#6  0x00007ffff77a26f3 in read (__nbytes=24, __buf=0x7fffffffdf70, __fd=<optimized out>) at /usr/include/bits/unistd.h:39
#7  flushhw () at irrecord.c:145
#8  0x0000555555558492 in lirccode_get_lengths (opts=0x7fffffffe0b0, state=0x7fffffffe070) at irrecord-ui.cpp:984
#9  0x0000555555556c36 in main (argc=<optimized out>, argv=<optimized out>) at irrecord-ui.cpp:1155

The following diff on lib/irrecord.c fixes the crash:

132,133c132
< 
<   char *buffer = malloc(sizeof(ir_code));
---
>   char buffer[sizeof(ir_code)];
146,149d144
< 
<   if(size > sizeof(ir_code))
<       buffer = realloc(buffer, size);
< 
152,153d146
< 
<   free(buffer);

More information:
It seems that size is set to 24 while buffer is only 8 bytes.

[Alec Leamas]

Duplicate of [#208]. Note the default driver issue described there. Thanks for reporting!

[erroneous_1]

You're right that the patch in ebd3cf fixes my issue. Changing the driver from auto to default or default to auto or specifying the driver on the command line did not work without the patch.

[Alec Leamas]

Odd. Anyway, note that 0.9.4b is released with this patch on board.