Bug 2190103 - Buffer overflow in FvwmAuto
Summary: Buffer overflow in FvwmAuto
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: fvwm
Version: 40
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Peter Lemenkov
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-04-27 07:08 UTC by nvwarr
Modified: 2024-09-17 02:57 UTC (History)
3 users (show)

Fixed In Version: fvwm-2.7.0-13.fc41 fvwm-2.7.0-13.fc39 fvwm-2.7.0-13.fc40
Clone Of:
Environment:
Last Closed: 2024-09-10 09:36:08 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
patch to fix it (309 bytes, patch)
2023-04-27 07:09 UTC, nvwarr
no flags Details | Diff

Description nvwarr 2023-04-27 07:08:15 UTC
When the autoraise function FvwmAuto is activated, it crashes immediately.


Reproducible: Always

Steps to Reproduce:
1. Turn on the autoraise feature FvwmAuto

Actual Results:  
FvwmAuto crashes giving a message in the system journal. Autoraise doesn't happen.

Expected Results:  
Autoraise should be activated.

The problem is that in FvwmAuto.c lines 334 to 346 it tries to work out the necessary size of a buffer big enough for the entry_fn or leave_fn. Then it allocates this size. However, when it uses it, it adds a \n character and, of course, the null terminator, causing a buffer overflow.

In previous versions of Fedora, this somehow worked, but now the hardening has turned this bug into a crash.

I don't see how to attach a patch here, but it is fixed by just a one liner, adding

    len += 2;

at line 347 right before the safemalloc (or you could just change the safemalloc(len) to safemalloc(len+2).

Comment 1 nvwarr 2023-04-27 07:09:38 UTC
Created attachment 1960298 [details]
patch to fix it

Ah, the button to add a patch is on the next page! Here it is.

Comment 2 nvwarr 2023-11-19 05:17:33 UTC
This still isn't fixed in Fedora 39. The fix is still to just allocate two bytes more.

Comment 3 nvwarr 2024-05-07 06:33:02 UTC
This still isn't fixed in Fedora 40 and it is still a trivial fix with a patch provided.

Comment 4 Aoife Moloney 2024-05-07 16:12:46 UTC
This message is a reminder that Fedora Linux 38 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 38 on 2024-05-21.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '38'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version' 
to a later Fedora Linux version. Note that the version field may be hidden.
Click the "Show advanced fields" button if you do not see it.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora Linux 38 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora Linux, you are encouraged to change the 'version' to a later version
prior to this bug being closed.

Comment 5 nvwarr 2024-05-07 16:25:08 UTC
I just posted this morning that the problem isn't fixed in Fedora 40.

Comment 6 Richard Harman 2024-09-06 23:40:16 UTC
I can confirm, after building my own rpm package with the patch suggested by @nvwarr that FvwmAuto now builds, and performs correctly.  Thanks!  Hopefully this patch gets applied and fixed. This has plagued me for months and months now.

Comment 7 Fedora Update System 2024-09-07 10:43:20 UTC
FEDORA-2024-527d1451f5 (fvwm-2.7.0-13.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-527d1451f5

Comment 8 Fedora Update System 2024-09-07 10:43:20 UTC
FEDORA-2024-0a7b807e91 (fvwm-2.7.0-13.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-0a7b807e91

Comment 9 Fedora Update System 2024-09-07 10:43:21 UTC
FEDORA-2024-ab40ea1a6d (fvwm-2.7.0-13.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-ab40ea1a6d

Comment 10 Fedora Update System 2024-09-09 02:07:05 UTC
FEDORA-2024-ab40ea1a6d has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-ab40ea1a6d`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-ab40ea1a6d

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2024-09-09 15:19:09 UTC
FEDORA-2024-527d1451f5 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-527d1451f5`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-527d1451f5

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Fedora Update System 2024-09-09 19:25:12 UTC
FEDORA-2024-0a7b807e91 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-0a7b807e91`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-0a7b807e91

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 nvwarr 2024-09-10 09:36:08 UTC
Good, this seems to sort it out.

Richard, you seem to have set a flag indicating you need info from me. I'm just a user, so I have no influence over the updates and I don't know what info you want. Maybe this was just added on automatically, when you cited me. Anyway, it seems to have provoked the desired update, so thanks for that.

I think we can close now.

Comment 14 Fedora Update System 2024-09-13 20:54:36 UTC
FEDORA-2024-ab40ea1a6d (fvwm-2.7.0-13.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 15 Fedora Update System 2024-09-17 02:06:58 UTC
FEDORA-2024-527d1451f5 (fvwm-2.7.0-13.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2024-09-17 02:57:41 UTC
FEDORA-2024-0a7b807e91 (fvwm-2.7.0-13.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.