Your message dated Mon, 13 Jul 2026 05:33:56 +0000
with message-id <[email protected]>
and subject line Bug#1132989: fixed in foremost 1.5.7-12
has caused the Debian Bug report #1132989,
regarding foremost: Invalid memory access with no arguments given
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1132989: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132989
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: foremost
Version: 1.5.7-11
Severity: normal
X-Debbugs-Cc: [email protected]
Dear Maintainer,
when executing foremost without any arguments an invalid memory access
occurs in file config.c line 201. Then, len = 1, which results in
buffer[1 - 2] and thefore accesses memory out of buffer.
I found the problem on an arm64 machine with Memory Tagging enabled, however,
it is also findable with valgrind. So, command to reproduce:
docker run --rm -e DEBUGINFOD_URLS="https://debuginfod.debian.net";
debian:trixie bash -lc 'apt-get update && apt-get install -y valgrind
debuginfod && valgrind /usr/bin/foremost'
valgrind finds even more issues, actually:
==1== Invalid read of size 1
==1== at 0x10D5FE: process_line (config.c:201)
==1== by 0x10D8B0: load_config_file (config.c:320)
==1== by 0x10A42E: main (main.c:246)
==1== Address 0x4a5598f is 1 bytes before a block of size 1,024 alloc'd
==1== at 0x4844818: malloc (vg_replace_malloc.c:446)
==1== by 0x10D87D: load_config_file (config.c:291)
==1== by 0x10A42E: main (main.c:246)
==1==
==1== Conditional jump or move depends on uninitialised value(s)
==1== at 0x48539C2: strstr (vg_replace_strmem.c:1814)
==1== by 0x10EFA0: create_sub_dirs (dir.c:273)
==1== by 0x10A6A5: main (main.c:262)
==1==
==1== Conditional jump or move depends on uninitialised value(s)
==1== at 0x48539EF: strstr (vg_replace_strmem.c:1814)
==1== by 0x10EFA0: create_sub_dirs (dir.c:273)
==1== by 0x10A6A5: main (main.c:262)
==1==
==1== Conditional jump or move depends on uninitialised value(s)
==1== at 0x48539EA: strstr (vg_replace_strmem.c:1814)
==1== by 0x10EFA0: create_sub_dirs (dir.c:273)
==1== by 0x10A6A5: main (main.c:262)
-- System Information:
Debian Release: 12.13
APT prefers oldstable-updates
APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500,
'oldstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.12+bpo-amd64 (SMP w/512 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages foremost depends on:
ii libc6 2.36-9+deb12u13
foremost recommends no packages.
foremost suggests no packages.
--- End Message ---
--- Begin Message ---
Source: foremost
Source-Version: 1.5.7-12
Done: Raúl Benencia <[email protected]>
We believe that the bug you reported is fixed in the latest version of
foremost, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Raúl Benencia <[email protected]> (supplier of updated foremost package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 12 Jul 2026 22:02:43 -0700
Source: foremost
Binary: foremost foremost-dbgsym
Architecture: source amd64
Version: 1.5.7-12
Distribution: unstable
Urgency: medium
Maintainer: Raúl Benencia <[email protected]>
Changed-By: Raúl Benencia <[email protected]>
Description:
foremost - forensic program to recover lost files
Closes: 1132989
Changes:
foremost (1.5.7-12) unstable; urgency=medium
.
* Fix out-of-bounds read on empty configuration-file lines: guard the
CRLF check in process_line() with len >= 2 so a blank line (len == 1)
no longer reads before the buffer. (Closes: #1132989)
* d/control: bump Standards-Version to 4.7.4 and debhelper compat to 14;
update Maintainer to [email protected]; drop the redundant Priority and
Rules-Requires-Root fields.
* d/copyright: reference the GPL by URL instead of the FSF postal address.
* d/patches: add DEP-3 Forwarded/Last-Update headers to all patches.
* d/watch: convert to uscan format 5.
* d/tests: add an autopkgtest that carves an embedded HTML payload.
Checksums-Sha1:
7377e15c117813f56440dc390b916a519ebbf252 1900 foremost_1.5.7-12.dsc
9e4858d0d2a135aa0345673edd69da40d02ad6d3 11096 foremost_1.5.7-12.debian.tar.xz
b8033bdb172b51bebed0574a2b48c56de91c098e 84980
foremost-dbgsym_1.5.7-12_amd64.deb
d5921da1ff663a1d836c6041e38f649d6a8589a3 5934 foremost_1.5.7-12_amd64.buildinfo
073f3f69706de2db798bc208d02b837ae1e6cf78 41512 foremost_1.5.7-12_amd64.deb
Checksums-Sha256:
c94628799f657ad28218ab777d13c0ae66b060ab1629904402b2442a38a76915 1900
foremost_1.5.7-12.dsc
61c7ed470847e88396462034b964c087a4f77ef11f10b1f7bdc387b0b679c1d9 11096
foremost_1.5.7-12.debian.tar.xz
67cad2b48498cb38e635db86e619fbc611ce9fb44601dc26ef02ffadd5c5804b 84980
foremost-dbgsym_1.5.7-12_amd64.deb
2431ce007bf9c88e5be97c24ad2b0ce0b5a3c64a4c78b23ed538c2e56e008627 5934
foremost_1.5.7-12_amd64.buildinfo
499df4f7209cab6ea1024901d58223ee6c0c99e924d2c590ccac72c8217e92fb 41512
foremost_1.5.7-12_amd64.deb
Files:
de532016953dbff9a6b13b3fe8412018 1900 admin optional foremost_1.5.7-12.dsc
c07155f070d7581bf1d13578293d837f 11096 admin optional
foremost_1.5.7-12.debian.tar.xz
2b6983a8b09e4976b4e86dc128338e64 84980 debug optional
foremost-dbgsym_1.5.7-12_amd64.deb
81c25aafebfb6fe97e711851ceb52840 5934 admin optional
foremost_1.5.7-12_amd64.buildinfo
b6f53af72663dbedce522f855bfbc7c2 41512 admin optional
foremost_1.5.7-12_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQJDBAEBCgAtFiEEFq0pz1dK0CBvmWHgLPDxfENHS28FAmpUda4PHHJ1bEBkZWJp
YW4ub3JnAAoJECzw8XxDR0tvuVoP/3C2ybS9VJ8Hw0HrTZHqr6vFu9jqQUsJCGz+
BfibUrSm5r3ycyy52/r/MLbFSIuDIZOr8F2cYRVU9+6u7LIcyjQVtu3gAlY48891
HGy7UMpy24XP0OcjXfpgUQ77uEdg8Dy8/EP6HZ858QTDQCCqIxcAOWZJyZUEE/9I
StBorP4NniH+4AOSZN0UkOTfaKJ1e6wOSvbGuLLw9rHz8HXJyI6jmVjecMji6fB6
Xf9BBXYOOaVG+vPHTUSNOKJpleEvOjqS/gmYueI15x078WPrsC/SkiZXKPXhAFOL
ypw9ly9OAQHWz4djpc/EiVQDRHOOkx8+L3/OKAlJ95YrT0eyPXXyWMX5OEgaWBQV
SuPiAI9GRNGfGewbsLeqjbcbpR4cJKW3pHLntkOYC3ScSsxLekt7KAPg/hK+bV0V
O9zBDgBSaE6TaaNuQRhgmQ6mzt7julIVACGbO5m3ExinZ8GajCET8mPJ0BBLgARQ
THiIcTW5BGYgrTcD62iUCg5qqqeFniLwitiudSaZDpG9rKyAgvPSXF7tkUeduRhQ
RqU6bXWY8F+i107pGvwNDGPa1EWQOoHC6Iip7hEO2eCzAPbnphSD+XgFuF1xbVPL
2dh5VqTilfwLz4B+MWPO4YAksXjX/RS6r2/eQIER/voHIhj9AFVc2pBsXz3E98aE
cJkNig4b
=IY03
-----END PGP SIGNATURE-----
pgpqHyIZUG8i0.pgp
Description: PGP signature
--- End Message ---
