Bug in return_append_str

Mark Hermeling <[email protected]> Fri, 30 Jun 2017 14:20:09 +0200
Newsgroups	gmane.comp.gnu.chess.bugs
Message-ID	<[email protected]>
--===============8391799232738019024==
Content-Type: multipart/alternative;
 boundary="Apple-Mail=_0414C1BC-D337-4433-ABC4-998BD56099BD"


--Apple-Mail=_0414C1BC-D337-4433-ABC4-998BD56099BD
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hello,

There is a buffer overrun in return_append_str in src/frontend/lexpgn.cc =
at line
2224	                newloc =3D (char *) malloc(strlen(s))+1;

The line should read:
newloc =3D (char *) malloc(strlen(s)+1);

We found this using static analysis using CodeSonar. I don=E2=80=99t =
have an actual path that will demonstrate this bug.

Regards,
Mark

=E2=80=94
Mark Hermeling | GrammaTech | Senior Director Product Marketing
mobile +1 (607) 351-5719 | www.grammatech.com













--Apple-Mail=_0414C1BC-D337-4433-ABC4-998BD56099BD
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D"">Hello,<div class=3D""><br class=3D""></div><div =
class=3D"">There is a buffer overrun in return_append_str in =
src/frontend/<a href=3D"http://lexpgn.cc" class=3D"">lexpgn.cc</a> at =
line</div><div class=3D""><table cellspacing=3D"0" cellpadding=3D"0" =
style=3D"width: 1273px; margin: 0px; border: none; color: rgb(0, 0, 0); =
font-family: sans-serif;" class=3D""><tbody class=3D""><tr =
class=3D"vc_row_odd" id=3D"l2224" style=3D"vertical-align: top; =
background-color: rgb(240, 240, 240);"><td class=3D"vc_file_line_number" =
style=3D"vertical-align: top; border-right-width: 1px; background-color: =
rgb(238, 238, 238); color: rgb(80, 80, 80); text-align: right; =
border-right-style: solid; border-right-color: rgb(80, 80, 80); padding: =
1px 5px;">2224</td><td class=3D"vc_file_line_text" =
style=3D"vertical-align: top; border-right-width: 0px; background-color: =
white; font-family: monospace; white-space: pre; width: 1216.40625px; =
border-right-style: solid; border-right-color: rgb(80, 80, 80); padding: =
1px 5px;">                <span class=3D"pygments-n">newloc</span> <span =
class=3D"pygments-o" style=3D"color: rgb(102, 102, 102);">=3D</span> =
<span class=3D"pygments-p">(</span><span class=3D"pygments-kt" =
style=3D"color: rgb(176, 0, 64);">char</span> <span class=3D"pygments-o" =
style=3D"color: rgb(102, 102, 102);">*</span><span =
class=3D"pygments-p">)</span> <span =
class=3D"pygments-n">malloc</span><span class=3D"pygments-p">(</span><span=
 class=3D"pygments-n">strlen</span><span =
class=3D"pygments-p">(</span><span class=3D"pygments-n">s</span><span =
class=3D"pygments-p">))</span><span class=3D"pygments-o" style=3D"color: =
rgb(102, 102, 102);">+</span><span class=3D"pygments-mi" style=3D"color: =
rgb(102, 102, 102);">1</span><span =
class=3D"pygments-p">;</span></td></tr></tbody></table><div class=3D""><br=
 class=3D""></div></div><div class=3D"">The line should read:</div><div =
class=3D""><span class=3D"pygments-n" style=3D"font-family: monospace; =
white-space: pre; background-color: rgb(255, 255, =
255);">newloc</span><span style=3D"font-family: monospace; font-size: =
medium; white-space: pre; background-color: rgb(255, 255, 255);" =
class=3D""> </span><span class=3D"pygments-o" style=3D"font-family: =
monospace; white-space: pre; background-color: rgb(255, 255, 255); =
color: rgb(102, 102, 102);">=3D</span><span style=3D"font-family: =
monospace; font-size: medium; white-space: pre; background-color: =
rgb(255, 255, 255);" class=3D""> </span><span class=3D"pygments-p" =
style=3D"font-family: monospace; white-space: pre; background-color: =
rgb(255, 255, 255);">(</span><span class=3D"pygments-kt" =
style=3D"font-family: monospace; white-space: pre; background-color: =
rgb(255, 255, 255); color: rgb(176, 0, 64);">char</span><span =
style=3D"font-family: monospace; font-size: medium; white-space: pre; =
background-color: rgb(255, 255, 255);" class=3D""> </span><span =
class=3D"pygments-o" style=3D"font-family: monospace; white-space: pre; =
background-color: rgb(255, 255, 255); color: rgb(102, 102, =
102);">*</span><span class=3D"pygments-p" style=3D"font-family: =
monospace; white-space: pre; background-color: rgb(255, 255, =
255);">)</span><span style=3D"font-family: monospace; font-size: medium; =
white-space: pre; background-color: rgb(255, 255, 255);" class=3D""> =
</span><span class=3D"pygments-n" style=3D"font-family: monospace; =
white-space: pre; background-color: rgb(255, 255, =
255);">malloc</span><span class=3D"pygments-p" style=3D"font-family: =
monospace; white-space: pre; background-color: rgb(255, 255, =
255);">(</span><span class=3D"pygments-n" style=3D"font-family: =
monospace; white-space: pre; background-color: rgb(255, 255, =
255);">strlen</span><span class=3D"pygments-p" style=3D"font-family: =
monospace; white-space: pre; background-color: rgb(255, 255, =
255);">(</span><span class=3D"pygments-n" style=3D"font-family: =
monospace; white-space: pre; background-color: rgb(255, 255, =
255);">s</span><span class=3D"pygments-p" style=3D"font-family: =
monospace; white-space: pre; background-color: rgb(255, 255, =
255);">)+1)</span><span class=3D"pygments-p" style=3D"font-family: =
monospace; white-space: pre; background-color: rgb(255, 255, =
255);">;</span></div><div class=3D""><span class=3D"pygments-p" =
style=3D"font-family: monospace; white-space: pre; background-color: =
rgb(255, 255, 255);"><br class=3D""></span></div><div class=3D""><font =
face=3D"monospace" class=3D""><span style=3D"background-color: rgb(255, =
255, 255);" class=3D""><span style=3D"white-space: pre;" class=3D"">We =
found this using static analysis using CodeSonar. I don=E2=80=99t have =
an actual path that will demonstrate this =
bug.</span></span></font></div><div class=3D""><br class=3D""></div><div =
class=3D"">Regards,</div><div class=3D"">Mark</div><div class=3D""><br =
class=3D""><div class=3D"">
<div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; text-align: =
start; text-indent: 0px; text-transform: none; white-space: normal; =
word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: =
break-word; -webkit-nbsp-mode: space; -webkit-line-break: =
after-white-space;" class=3D""><div style=3D"color: rgb(0, 0, 0); =
letter-spacing: normal; text-align: start; text-indent: 0px; =
text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: =
break-word; -webkit-nbsp-mode: space; -webkit-line-break: =
after-white-space;" class=3D""><div style=3D"color: rgb(0, 0, 0); =
letter-spacing: normal; text-align: start; text-indent: 0px; =
text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: =
break-word; -webkit-nbsp-mode: space; -webkit-line-break: =
after-white-space;" class=3D""><div style=3D"color: rgb(0, 0, 0); =
letter-spacing: normal; text-align: start; text-indent: 0px; =
text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: =
break-word; -webkit-nbsp-mode: space; -webkit-line-break: =
after-white-space;" class=3D""><div style=3D"color: rgb(0, 0, 0); =
letter-spacing: normal; text-align: start; text-indent: 0px; =
text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><div style=3D"word-wrap: break-word; -webkit-nbsp-mode: =
space; -webkit-line-break: after-white-space;" class=3D""><div =
style=3D"color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; =
font-style: normal; font-variant-caps: normal; font-weight: normal; =
letter-spacing: normal; text-align: start; text-indent: 0px; =
text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px;">=E2=80=94</div><div style=3D"color: =
rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: =
normal; font-variant-caps: normal; font-weight: normal; letter-spacing: =
normal; text-align: start; text-indent: 0px; text-transform: none; =
white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: =
0px;">Mark Hermeling |&nbsp;<b class=3D"">Gramma<font color=3D"#d72332" =
class=3D"">Tech</font></b>&nbsp;| Senior Director Product Marketing<br =
class=3D"">mobile +1 (607) 351-5719 | <a =
href=3D"http://www.grammatech.com" =
class=3D"">www.grammatech.com</a></div><div style=3D"color: rgb(0, 0, =
0); font-family: Helvetica; font-size: 12px; font-style: normal; =
font-variant-caps: normal; font-weight: normal; letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=3D""><br=
 class=3D""></div><br class=3D"Apple-interchange-newline"></div></div><br =
class=3D"Apple-interchange-newline"></div><br =
class=3D"Apple-interchange-newline"></div><br =
class=3D"Apple-interchange-newline"></div><br =
class=3D"Apple-interchange-newline"></div><br =
class=3D"Apple-interchange-newline"></div><br =
class=3D"Apple-interchange-newline"></div><br =
class=3D"Apple-interchange-newline"></div><br =
class=3D"Apple-interchange-newline"><br =
class=3D"Apple-interchange-newline">
</div>
<br class=3D""></div></body></html>=

--Apple-Mail=_0414C1BC-D337-4433-ABC4-998BD56099BD--


--===============8391799232738019024==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Bug-gnu-chess mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/bug-gnu-chess

--===============8391799232738019024==--