_FROTIFY_SOURCE=3
ensures that buffer sizes passed to weel known
functions like snprintf()
don't get outside of known buffer sizes at
runtime.
In case of mikmod
the crash happened in display_header ()
:
(gdb) bt
0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
1 0x00007ffff7c68093 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
2 0x00007ffff7c18e06 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
3 0x00007ffff7c018f5 in __GI_abort () at abort.c:79
4 0x00007ffff7c027a1 in __libc_message (fmt=fmt@entry=0x7ffff7d7a2f8 "*** %s ***: terminated\n")
at ../sysdeps/posix/libc_fatal.c:150
5 0x00007ffff7cf70c9 in __GI___fortify_fail (msg=msg@entry=0x7ffff7d7a2df "buffer overflow detected") at fortify_fail.c:24
6 0x00007ffff7cf6a84 in __GI___chk_fail () at chk_fail.c:28
7 0x00007ffff7cf8275 in ___snprintf_chk (s=<optimized out>, maxlen=<optimized out>, flag=<optimized out>,
slen=<optimized out>, format=<optimized out>) at snprintf_chk.c:29
8 0x0000000000405578 in snprintf (__fmt=<optimized out>, __n=<optimized out>, __s=<optimized out>)
at /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-glibc-2.38-27-dev/include/bits/stdio2.h:54
9 display_information () at display.c:548
10 0x00000000004078b3 in display_header () at display.c:1153
11 0x0000000000407901 in display_head_repaint (win=<optimized out>) at display.c:1168
12 0x000000000040e192 in win_panel_repaint () at mwindow.c:632
13 0x000000000040eb63 in win_change_panel (new_panel=<optimized out>) at mwindow.c:921
14 0x00000000004054bc in display_information () at display.c:533
15 0x00000000004078b3 in display_header () at display.c:1153
16 0x0000000000407901 in display_head_repaint (win=<optimized out>) at display.c:1168
17 0x000000000040e192 in win_panel_repaint () at mwindow.c:632
18 0x000000000040eb63 in win_change_panel (new_panel=<optimized out>) at mwindow.c:921
19 0x00000000004079f2 in display_init () at display.c:1253
20 0x000000000040a9ef in main (argc=1, argv=0x7fffffffce08) at mikmod.c:1058
The change makes sure that paneltitle
never gets overran by accounting
the existing offset.
Thanks for the patch, and sorry that it took a long time for me to notice it.
Patch looks sensible and I'll be applying it shortly. But can you tell me with
what kind of a string did you hit this buffer overrun?
Patch is in.