| Summary: | kst data wizard crashes with sigabrt on certain file names | ||
|---|---|---|---|
| Product: | [Applications] kst | Reporter: | Bastien Chevreux <bach> |
| Component: | general | Assignee: | kst |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | ||
| Priority: | NOR | ||
| Version: | 1.x | ||
| Target Milestone: | --- | ||
| Platform: | openSUSE | ||
| OS: | Linux | ||
| Latest Commit: | Version Fixed In: | ||
| Sentry Crash Report: | |||
| Attachments: | strcpy == evil; strncpy == less evil | ||
|
Description
Bastien Chevreux
2007-03-02 22:19:13 UTC
This is clearly a string overflow bug in the shipped but no longer maintained readdata/frame file data source. I can fix it, but for most people (eg, everyone who isn't reading 1997 Boomerang data - ie, everyone), an adequate fix would be to remove this data source. On Friday 02 March 2007 4:19:16 pm Bastien Chevreux wrote: [bugs.kde.org quoted mail] Created attachment 20113 [details]
strcpy == evil; strncpy == less evil
as expected, we were overflowing the filename.
This 'fix' will stop kst from crashing, and will let you use really long
filenames on all data sources that support them...
important for 1.4
Looks good. -- George Staikos KDE Developer http://www.kde.org/ Staikos Computing Services Inc. http://www.staikos.net/ SVN commit 647569 by netterfield:
BUG: 142420
strcpy -> strncpy
M +4 -3 creaddata.c
M +3 -2 readdata.c
--- trunk/extragear/graphics/kst/src/datasources/frame/creaddata.c #647568:647569
@@ -24,6 +24,7 @@
#define MAX_LINE_LENGTH 120
#define MAX_FIELDS_IN_CFORMAT 500
#define MAX_LINCOM_ENTRIES 4
+#define MAX_FILENAMELEN 256
#ifndef CALSPECS_DIR
#define CALSPECS_DIR "/data/etc"
@@ -838,7 +839,7 @@
int i_format, i_field, i_lincom;
int s_per_frame;
static int first_time=1;
- char filename[100], tmpfilename[100];
+ char filename[MAX_FILENAMELEN], tmpfilename[MAX_FILENAMELEN];
int i, n_read;
void *tmpbuf;
int *mp_cnt=NULL, *mp_data, cp_data;
@@ -852,7 +853,7 @@
return(0);
}
- strcpy(filename, filename_in);
+ strncpy(filename, filename_in, MAX_FILENAMELEN-2);
if (first_time) {
*error_code = ReadCalFile();
@@ -900,7 +901,7 @@
/* Find t0 from the file creation time */
t0 = FindT0(filename_in, cstruct[i_format].field[i_field].framerate);
/* Find f0 from reading the first frame val */
- strcpy(tmpfilename, filename);
+ strncpy(tmpfilename, filename, MAX_FILENAMELEN-2);
tmpfilename[strlen(tmpfilename)-2] = '0';
tmpfilename[strlen(tmpfilename)-1] = '0';
--- trunk/extragear/graphics/kst/src/datasources/frame/readdata.c #647568:647569
@@ -27,6 +27,7 @@
#include "readdata.h"
#define MAX_LINE_LENGTH 120
#define MAX_FIELDS_IN_FORMAT 500
+#define MAX_FILENAMELEN 256
#ifndef FILEFORMATS_DIR
#define FILEFORMATS_DIR "/data/etc"
@@ -782,9 +783,9 @@
char done='n';
unsigned char *data_buffer;
int fp;
- char filename[100];
+ char filename[MAX_FILENAMELEN];
- strcpy(filename, filename_in);
+ strncpy(filename, filename_in, MAX_FILENAMELEN-2);
/****************************/
/* Read the FileFormat file */
|