Buffer overflow issue in gnuchess

--===============7603300341644492237==
Content-Type: multipart/alternative; boundary="=-uQK7OCpYKYpKGN3Ghy0y"

--=-uQK7OCpYKYpKGN3Ghy0y
Content-Type: text/plain; charset=utf-8; format=flowed

Hello,

There seems to be a buffer overflow vulnerability in gnuchess version 
6.1.1.
I think it's possible there is some remote attack vector via network 
play, but I haven't studied it further.

The issue can be reproduced like this:

$ gnuchess

GNU Chess 6.1.1
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
White (1) : 
1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
TimeLimit[0] = 0
TimeLimit[1] = 0
Invalid move: 
1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
White (1) : 
11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
TimeLimit[0] = 0
TimeLimit[1] = 0
*** stack smashing detected ***: gnuchess terminated
[1] 30500 abort (core dumped) gnuchess



    BR, Antti Karjalainen



--=-uQK7OCpYKYpKGN3Ghy0y
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hello,<div><br></div><div>There seems to be a buffer overflow vulnerability=
 in gnuchess version 6.1.1.</div><div>I think it's possible there is some r=
emote attack vector via network play, but I haven't studied it further.</di=
v><div><br></div><div>The issue can be reproduced like this:</div><div><br>=
</div><div>$ gnuchess</div><div><br></div><div>GNU Chess 6.1.1</div><div>Co=
pyright (C) 2013 Free Software Foundation, Inc.</div><div>License GPLv3+: G=
NU GPL version 3 or later &lt;<a href=3D"http://gnu.org/licenses/gpl.html">=
http://gnu.org/licenses/gpl.html</a>&gt;</div><div>This is free software: y=
ou are free to change and redistribute it.</div><div>There is NO WARRANTY, =
to the extent permitted by law.</div><div>White (1) : 111111111111111111111=
111111111111111111111111111111111111111111111111111111111111111111111111111=
1111111111111111111111111111111111</div><div>TimeLimit[0] =3D 0</div><div>T=
imeLimit[1] =3D 0</div><div>Invalid move: 111111111111111111111111111111111=
111111111111111111111111111111111111111111111111111111111111111111111111111=
1111111111111111111111</div><div>White (1) : 111111111111111111111111111111=
111111111111111111111111111111111111111111111111111111111111111111111111111=
11111111111111111111111111111111111111111111111</div><div>TimeLimit[0] =3D =
0</div><div>TimeLimit[1] =3D 0</div><div>*** stack smashing detected ***: g=
nuchess terminated</div><div>[1]    30500 abort (core dumped)  gnuchess</di=
v><div><br></div><div><br></div><div><br></div><div>&nbsp; &nbsp; BR, Antti=
 Karjalainen</div><div><br></div>=

--=-uQK7OCpYKYpKGN3Ghy0y--



--===============7603300341644492237==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Bug-gnu-chess mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/bug-gnu-chess

--===============7603300341644492237==--