Package: xpat2 Version: 1.07-19 Severity: important Tags: patch Dear Maintainer,
Trying to save any game in xpat2 under Debian Jessie always triggers a crash with the following message: *** stack smashing detected ***: xpat2 terminated A file corresponding to the game to save is created nonetheless, but this file cannot be re-read by xpat2. A quick investigation of this issue (thanks to valgrind) lead me to the function save_game in src/loadsave.c, where the "args" and "p" variables have an hardcoded length of 24 and 4*24, while (at least) the line 228 (calling internal_to_portable) seems to expect them to have length NARGS and 4*NARGS. And NARGS is defined to 32 at the top of this file. Using NARGS instead of 24 in the definition of "args" and "p" (see attached patch) seems to fix this issue : no more crash and the saved files can be re-read successfully by xpat2. Best regards (and thanks for providing this great game) Pierre L. -- System Information: Debian Release: 8.3 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores) Locale: LANG=fr_FR.utf8, LC_CTYPE=fr_FR.utf8 (charmap=UTF-8) (ignored: LC_ALL set to fr_FR.utf8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages xpat2 depends on: ii libc6 2.19-18+deb8u3 ii libx11-6 2:1.6.2-3 ii libxaw7 2:1.0.12-2+b1 ii libxmu6 2:1.1.2-1 ii libxpm4 1:3.5.11-1+b1 ii libxt6 1:1.1.4-1+b1 xpat2 recommends no packages. xpat2 suggests no packages. -- no debconf information
--- src/loadsave.c 2016-03-01 12:31:14.000000000 +0100 +++ src/loadsave.c.fixed 2016-03-01 12:32:06.757014851 +0100 @@ -157,11 +157,11 @@ void save_game(const char *file) { FILE *fp; - char buffer[32]; + char buffer[BUFSIZE]; char filename[64]; /* must be 15 at least */ - long args[24]; + long args[NARGS]; int i; - unsigned char p[4 * 24]; + unsigned char p[4 * NARGS]; if (!file) { /* compute the filename to use */