Bug 2115476

Summary:	possible off-by-one exposed when building with _FORTIFY_SOURCE=3
Product:	[Fedora] Fedora	Reporter:	Siddhesh Poyarekar <sipoyare>
Component:	clisp	Assignee:	Jerry James <loganjerry>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	gemi, green, loganjerry
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	clisp-2.49.93-25.20210628gitde01f0f.fc37	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-08 19:25:25 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Siddhesh Poyarekar 2022-08-04 18:42:12 UTC

Description of problem:
Build log:

https://download.copr.fedorainfracloud.org/results/siddhesh/mpb.1/fedora-rawhide-x86_64/04659430-clisp/builder-live.log.gz

It looks like the test:

/root/rpmbuild/BUILD/clisp-de01f0f47bb44d3a0f9e842464cf2520b238f356/build/base/lisp.run -B /root/rpmbuild/BUILD/clisp-de01f0f47bb44d3a0f9e842464cf2520b238f356/build -M /root/rpmbuild/BUILD/clisp-de01f0f47bb44d3a0f9e842464cf2520b238f356/build/base/lispinit.mem -N /root/rpmbuild/BUILD/clisp-de01f0f47bb44d3a0f9e842464cf2520b238f356/build/locale -E UTF-8 -Emisc 1:1 -Epathname 1:1 -norc -C -i tests/tests -x "(ext:exit (plusp (or (run-some-tests :dirlist '( \"i18n/\" \"syscalls/\" \"regexp/\" \"readline/\") :srcdir \"../modules/\" :outdir \"./\")\ 0)))"

aborts due to a buffer overflow when the package is built with -D_FORTIFY_SOURCE=3.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
Either install redhat-rpm-config from https://copr.fedorainfracloud.org/coprs/siddhesh/mpb.1/

OR

Edit /usr/lib/rpm/redhat/macros and change _FORTIFY_SOURCE=2 to _FORTIFY_SOURCE=3.

Actual results:
Abort due to buffer overflow.

Expected results:
No Abort.

Additional info:

The ENSURE_6X macro allocates name##_bytelen+6 for c_template, which doesn't seem to have enough space for a terminating NULL.  As a result this trips on the fortification check in __strcat_chk.

Comment 1 Jerry James 2022-08-04 19:50:39 UTC

Good find!  Upstream MR: https://gitlab.com/gnu-clisp/clisp/-/merge_requests/4.

Comment 2 Fedora Update System 2022-08-08 19:24:51 UTC

FEDORA-2022-1a7a746b45 has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2022-1a7a746b45

Comment 3 Fedora Update System 2022-08-08 19:25:25 UTC

FEDORA-2022-1a7a746b45 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.