Re: grdmath problems

Excellent Joachim; fixed in GMT 4 (r10188) and GMT5 (12781).
-p

On Jan 26, 2014, at 11:44 AM, Joachim Saul <[email protected]> wrote:

> Paul Wessel [26.01.2014 00:24]:
>> Are you doing this in the wrong dir or without 1.grd 2.grd present? When I add -V it prints out the commands as it is executing them.  Yours says it cannot find 1.grd which means that file is not there.  Please check, place the files, then rerun with -V and tell us how far grdmath gets before the crash.
> 
> -V is of no help here.
> 
> By adding a few breakpoints it quickly turned out that the buffer overflow occurs in GMT_grd_init() in gmt_grdio.c, where a struct GRD_HEADER is populated. That struct has a 'command' field with a fixed length of 320 bytes (GRD_COMMAND_LEN in gmt_grd.h). The buffer overflow occurs as soon as that limit is reached when composing the 'command' field.
> 
> There is actually a test in gmt_grdio.c line 745 meant to prevent that:
> 
> 	if (len > GRD_COMMAND_LEN) continue;
> 
> but this doesn't account for the terminating '\0' byte. If (and only if) len==GRD_COMMAND_LEN this will result in a write of one byte beyond the end of 'command' by strcat() causing the buffer overflow. Thus simply changing that line to
> 
> 	if (len >= GRD_COMMAND_LEN) continue;
> 
> fixes the issue.
> 
> I am baffled that valgrind didn't complain.
> 
> AFAICS the bug is still present in 5.1.0 (requires fixing line 1363 in gmt_grdio.c).
> 
> Regards
> Joachim
> 
> To unsubscribe, send the message "signoff gmt-help" to [email protected]

To unsubscribe, send the message "signoff gmt-help" to [email protected]