Public bug reported: pftools 3.2.12-3 has been stuck in stonking-proposed for ~248 days: missing build on amd64/amd64v3, two tests fail (execute_test_V3.sh, check_output_of_test_V3.sh):
$PFSEARCHV3 -n -t 1 -f -o 7 ./ecp.prf $TMPDIR/CVPBR322.fa # FASTA to TSV *** buffer overflow detected ***: terminated Aborted (core dumped) https://launchpad.net/ubuntu/+source/pftools/3.2.12-3/+build/32793542 This is a real heap overflow, caught by _FORTIFY_SOURCE=3 (Debian builds with level 2): #6 strcpy (__src="NS00001") at bits/string_fortified.h:93 #7 PrintTSV (...) at src/C/utils/output.c:68 char * ac = calloc(strlen(prf->AC_Number),sizeof(char)); strcpy(ac,prf->AC_Number); The buffer has no room for the NUL terminator. The other output functions in the same file already use 1+strlen(). Still the same in upstream master (v3.2.13). Fix (3.2.12-3ubuntu1): allocate 1+strlen(). Test-built in a stonking chroot: 100% tests passed (6/6). ** Affects: pftools (Ubuntu) Importance: Undecided Status: New ** Tags: ftbfs update-excuse ** Tags added: update-excuse ** Tags added: ftbfs -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170856 Title: pftools FTBFS: heap overflow in PrintTSV (pfsearchV3 -o 7) caught by _FORTIFY_SOURCE=3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/pftools/+bug/2170856/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
