Re: grdmath problems

Branden, 4.5.11 has not changed so for the fix you will need to install the latest GMT4 via subversion or wait for 4.5.12, possibly in a month or so.  Or you can bandaid your 4.5.11 code using the description below.

-p

On Jan 26, 2014, at 1:14 PM, Branden Christensen <[email protected]> wrote:

> Hi guys:
> 
> 
> Great news!
> 
> I am happy we found a bug and I was not wasting anyone's time chasing down something fictitious. 
> 
> Paul, I can now just use my script to download 4.5.11 again and recompile? Or what does protocol call for in this case?
> 
> 
> Kind Regards, 
> 
> 
> Branden Christensen
> The Seismo Guys Blog: http://www.osop.com.pa/blog/the-seismo-guys/
> Take a Virtual Tour: http://www.osop.com.pa/tour
> Sign up for the OSOP mailing list: http://www.osop.com.pa/about/osop-mailing-list/
> 
> 
> On Sun, Jan 26, 2014 at 10:57 PM, Paul Wessel <[email protected]> wrote:
> Excellent Joachim; fixed in GMT 4 (r10188) and GMT5 (12781).
> -p
> 
> On Jan 26, 2014, at 11:44 AM, Joachim Saul <[email protected]> wrote:
> 
> > Paul Wessel [26.01.2014 00:24]:
> >> Are you doing this in the wrong dir or without 1.grd 2.grd present? When I add -V it prints out the commands as it is executing them.  Yours says it cannot find 1.grd which means that file is not there.  Please check, place the files, then rerun with -V and tell us how far grdmath gets before the crash.
> >
> > -V is of no help here.
> >
> > By adding a few breakpoints it quickly turned out that the buffer overflow occurs in GMT_grd_init() in gmt_grdio.c, where a struct GRD_HEADER is populated. That struct has a 'command' field with a fixed length of 320 bytes (GRD_COMMAND_LEN in gmt_grd.h). The buffer overflow occurs as soon as that limit is reached when composing the 'command' field.
> >
> > There is actually a test in gmt_grdio.c line 745 meant to prevent that:
> >
> >       if (len > GRD_COMMAND_LEN) continue;
> >
> > but this doesn't account for the terminating '\0' byte. If (and only if) len==GRD_COMMAND_LEN this will result in a write of one byte beyond the end of 'command' by strcat() causing the buffer overflow. Thus simply changing that line to
> >
> >       if (len >= GRD_COMMAND_LEN) continue;
> >
> > fixes the issue.
> >
> > I am baffled that valgrind didn't complain.
> >
> > AFAICS the bug is still present in 5.1.0 (requires fixing line 1363 in gmt_grdio.c).
> >
> > Regards
> > Joachim
> >
> > To unsubscribe, send the message "signoff gmt-help" to [email protected]
> 
> To unsubscribe, send the message "signoff gmt-help" to [email protected]
> 
> To unsubscribe, send the message "signoff gmt-help" to [email protected]


To unsubscribe, send the message "signoff gmt-help" to [email protected]