Bug 1036161

Summary:	tmux: xsnprintf hardening
Product:	Red Hat Enterprise Linux 7	Reporter:	Florian Weimer <fweimer>
Component:	tmux	Assignee:	David Cantrell <dcantrell>
Status:	CLOSED WONTFIX	QA Contact:	Release Test Team <release-test-team>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	fweimer
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1264784 (view as bug list)		Environment:
Last Closed:	2020-12-15 07:28:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1036120

Description Florian Weimer 2013-11-29 15:32:01 UTC

xsnprintf makes fortify protection ineffect.  It should be an inline function or a #define.

The function does not guard against negative or oversized return values, and callers assume that it always returns values in the range [0, size - 1] (see arguments.c:args_print() for an
example).

Comment 2 David Cantrell 2013-12-12 16:38:20 UTC

Can you show me a patch for what you're looking for?

Comment 4 Florian Weimer 2014-06-09 11:12:40 UTC

(In reply to David Cantrell from comment #2)
> Can you show me a patch for what you're looking for?

An extensive explanation is available in this blog post: https://securityblog.redhat.com/2014/03/12/the-trouble-with-snprintf/

Comment 5 David Cantrell 2014-08-12 18:50:05 UTC

Denied by PM for 7.1, moving to 7.2 planning list.  :/

Comment 7 David Cantrell 2015-07-17 18:06:22 UTC

Denied by PM for 7.2, moving to the 7.3 planning list.

Comment 10 RHEL Program Management 2020-12-15 07:28:42 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.