Re: grdmath problems

Paul Wessel [26.01.2014 00:24]:
> Are you doing this in the wrong dir or without 1.grd 2.grd present? When I add -V it prints out the commands as it is executing them.  Yours says it cannot find 1.grd which means that file is not there.  Please check, place the files, then rerun with -V and tell us how far grdmath gets before the crash.

-V is of no help here.

By adding a few breakpoints it quickly turned out that the buffer overflow occurs in GMT_grd_init() in gmt_grdio.c, where a struct GRD_HEADER is populated. That struct has a 'command' field with a fixed length of 320 bytes (GRD_COMMAND_LEN in gmt_grd.h). The buffer overflow occurs as soon as that limit is reached when composing the 'command' field.

There is actually a test in gmt_grdio.c line 745 meant to prevent that:

	if (len > GRD_COMMAND_LEN) continue;

but this doesn't account for the terminating '\0' byte. If (and only if) len==GRD_COMMAND_LEN this will result in a write of one byte beyond the end of 'command' by strcat() causing the buffer overflow. Thus simply changing that line to

	if (len >= GRD_COMMAND_LEN) continue;

fixes the issue.

I am baffled that valgrind didn't complain.

AFAICS the bug is still present in 5.1.0 (requires fixing line 1363 in gmt_grdio.c).

Regards
Joachim

To unsubscribe, send the message "signoff gmt-help" to [email protected]