Re: grdmath problems

Hi guys:


Great news!

I am happy we found a bug and I was not wasting anyone's time chasing down
something fictitious.

Paul, I can now just use my script to download 4.5.11 again and recompile?
Or what does protocol call for in this case?


Kind Regards,


*Branden Christensen*
The Seismo Guys Blog: http://www.osop.com.pa/blog/the-seismo-guys/
Take a Virtual Tour: http://www.osop.com.pa/tour
Sign up for the OSOP mailing list:
http://www.osop.com.pa/about/osop-mailing-list/


On Sun, Jan 26, 2014 at 10:57 PM, Paul Wessel <[email protected]> wrote:

> Excellent Joachim; fixed in GMT 4 (r10188) and GMT5 (12781).
> -p
>
> On Jan 26, 2014, at 11:44 AM, Joachim Saul <[email protected]> wrote:
>
> > Paul Wessel [26.01.2014 00:24]:
> >> Are you doing this in the wrong dir or without 1.grd 2.grd present?
> When I add -V it prints out the commands as it is executing them.  Yours
> says it cannot find 1.grd which means that file is not there.  Please
> check, place the files, then rerun with -V and tell us how far grdmath gets
> before the crash.
> >
> > -V is of no help here.
> >
> > By adding a few breakpoints it quickly turned out that the buffer
> overflow occurs in GMT_grd_init() in gmt_grdio.c, where a struct GRD_HEADER
> is populated. That struct has a 'command' field with a fixed length of 320
> bytes (GRD_COMMAND_LEN in gmt_grd.h). The buffer overflow occurs as soon as
> that limit is reached when composing the 'command' field.
> >
> > There is actually a test in gmt_grdio.c line 745 meant to prevent that:
> >
> >       if (len > GRD_COMMAND_LEN) continue;
> >
> > but this doesn't account for the terminating '\0' byte. If (and only if)
> len==GRD_COMMAND_LEN this will result in a write of one byte beyond the end
> of 'command' by strcat() causing the buffer overflow. Thus simply changing
> that line to
> >
> >       if (len >= GRD_COMMAND_LEN) continue;
> >
> > fixes the issue.
> >
> > I am baffled that valgrind didn't complain.
> >
> > AFAICS the bug is still present in 5.1.0 (requires fixing line 1363 in
> gmt_grdio.c).
> >
> > Regards
> > Joachim
> >
> > To unsubscribe, send the message "signoff gmt-help" to
> [email protected]
>
> To unsubscribe, send the message "signoff gmt-help" to
> [email protected]
>

To unsubscribe, send the message "signoff gmt-help" to [email protected]