Re: Bug in return_append_str

--===============7122252128979603421==
Content-Type: multipart/alternative; boundary="94eb2c08233403244a05535cf8a5"

--94eb2c08233403244a05535cf8a5
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Mark,

Thanks for finding this potential bug and for providing a fix. However, How
would you reply to the comment that is written right before the line you
mentioned (I am not the author):

    /* This doesn't have buffer overflow vulnerabilities, because
       we always allocate for enough space before appending. */

Thanks,
Antonio Ceballos


On Fri, Jun 30, 2017 at 2:20 PM, Mark Hermeling <[email protected]>
wrote:

> Hello,
>
> There is a buffer overrun in return_append_str in src/frontend/lexpgn.cc
> at line
> 2224 newloc =3D (char *) malloc(strlen(s))+1;
>
> The line should read:
> newloc =3D (char *) malloc(strlen(s)+1);
>
> We found this using static analysis using CodeSonar. I don=E2=80=99t have=
 an
> actual path that will demonstrate this bug.
>
> Regards,
> Mark
>
> =E2=80=94
> Mark Hermeling | *GrammaTech* | Senior Director Product Marketing
> mobile +1 (607) 351-5719 <(607)%20351-5719> | www.grammatech.com
>
>
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
> Bug-gnu-chess mailing list
> [email protected]
> https://lists.gnu.org/mailman/listinfo/bug-gnu-chess
>
>

--94eb2c08233403244a05535cf8a5
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Mark,<div><br></div><div>Thanks for finding this potent=
ial bug and for providing a fix. However, How would you reply to the commen=
t that is written right before the line you mentioned (I am not the author)=
:</div><div><br></div><div><div>=C2=A0 =C2=A0 /* This doesn&#39;t have buff=
er overflow vulnerabilities, because</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0w=
e always allocate for enough space before appending. */</div></div><div><br=
></div><div>Thanks,</div><div>Antonio Ceballos</div><div><br></div></div><d=
iv class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Fri, Jun 30, 201=
7 at 2:20 PM, Mark Hermeling <span dir=3D"ltr">&lt;<a href=3D"mailto:mherme=
[email protected]" target=3D"_blank">[email protected]</a>&gt;</s=
pan> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex=
;border-left:1px #ccc solid;padding-left:1ex"><div style=3D"word-wrap:break=
-word">Hello,<div><br></div><div>There is a buffer overrun in return_append=
_str in src/frontend/<a href=3D"http://lexpgn.cc" target=3D"_blank">lexpgn.=
cc</a> at line</div><div><table cellspacing=3D"0" cellpadding=3D"0" style=
=3D"width:1273px;margin:0px;border:none;color:rgb(0,0,0);font-family:sans-s=
erif"><tbody><tr class=3D"m_7236857695585029220vc_row_odd" id=3D"m_72368576=
95585029220l2224" style=3D"vertical-align:top;background-color:rgb(240,240,=
240)"><td class=3D"m_7236857695585029220vc_file_line_number" style=3D"verti=
cal-align:top;border-right-width:1px;background-color:rgb(238,238,238);colo=
r:rgb(80,80,80);text-align:right;border-right-style:solid;border-right-colo=
r:rgb(80,80,80);padding:1px 5px">2224</td><td class=3D"m_723685769558502922=
0vc_file_line_text" style=3D"vertical-align:top;border-right-width:0px;back=
ground-color:white;font-family:monospace;white-space:pre-wrap;width:1216.40=
625px;border-right-style:solid;border-right-color:rgb(80,80,80);padding:1px=
 5px">                <span class=3D"m_7236857695585029220pygments-n">newlo=
c</span> <span class=3D"m_7236857695585029220pygments-o" style=3D"color:rgb=
(102,102,102)">=3D</span> <span class=3D"m_7236857695585029220pygments-p">(=
</span><span class=3D"m_7236857695585029220pygments-kt" style=3D"color:rgb(=
176,0,64)">char</span> <span class=3D"m_7236857695585029220pygments-o" styl=
e=3D"color:rgb(102,102,102)">*</span><span class=3D"m_7236857695585029220py=
gments-p">)</span> <span class=3D"m_7236857695585029220pygments-n">malloc</=
span><span class=3D"m_7236857695585029220pygments-p">(</span><span class=3D=
"m_7236857695585029220pygments-n">strlen</span><span class=3D"m_72368576955=
85029220pygments-p">(</span><span class=3D"m_7236857695585029220pygments-n"=
>s</span><span class=3D"m_7236857695585029220pygments-p">))</span><span cla=
ss=3D"m_7236857695585029220pygments-o" style=3D"color:rgb(102,102,102)">+</=
span><span class=3D"m_7236857695585029220pygments-mi" style=3D"color:rgb(10=
2,102,102)">1</span><span class=3D"m_7236857695585029220pygments-p">;</span=
></td></tr></tbody></table><div><br></div></div><div>The line should read:<=
/div><div><span class=3D"m_7236857695585029220pygments-n" style=3D"font-fam=
ily:monospace;white-space:pre-wrap;background-color:rgb(255,255,255)">newlo=
c</span><span style=3D"font-family:monospace;font-size:medium;white-space:p=
re-wrap;background-color:rgb(255,255,255)"> </span><span class=3D"m_7236857=
695585029220pygments-o" style=3D"font-family:monospace;white-space:pre-wrap=
;background-color:rgb(255,255,255);color:rgb(102,102,102)">=3D</span><span =
style=3D"font-family:monospace;font-size:medium;white-space:pre-wrap;backgr=
ound-color:rgb(255,255,255)"> </span><span class=3D"m_7236857695585029220py=
gments-p" style=3D"font-family:monospace;white-space:pre-wrap;background-co=
lor:rgb(255,255,255)">(</span><span class=3D"m_7236857695585029220pygments-=
kt" style=3D"font-family:monospace;white-space:pre-wrap;background-color:rg=
b(255,255,255);color:rgb(176,0,64)">char</span><span style=3D"font-family:m=
onospace;font-size:medium;white-space:pre-wrap;background-color:rgb(255,255=
,255)"> </span><span class=3D"m_7236857695585029220pygments-o" style=3D"fon=
t-family:monospace;white-space:pre-wrap;background-color:rgb(255,255,255);c=
olor:rgb(102,102,102)">*</span><span class=3D"m_7236857695585029220pygments=
-p" style=3D"font-family:monospace;white-space:pre-wrap;background-color:rg=
b(255,255,255)">)</span><span style=3D"font-family:monospace;font-size:medi=
um;white-space:pre-wrap;background-color:rgb(255,255,255)"> </span><span cl=
ass=3D"m_7236857695585029220pygments-n" style=3D"font-family:monospace;whit=
e-space:pre-wrap;background-color:rgb(255,255,255)">malloc</span><span clas=
s=3D"m_7236857695585029220pygments-p" style=3D"font-family:monospace;white-=
space:pre-wrap;background-color:rgb(255,255,255)">(</span><span class=3D"m_=
7236857695585029220pygments-n" style=3D"font-family:monospace;white-space:p=
re-wrap;background-color:rgb(255,255,255)">strlen</span><span class=3D"m_72=
36857695585029220pygments-p" style=3D"font-family:monospace;white-space:pre=
-wrap;background-color:rgb(255,255,255)">(</span><span class=3D"m_723685769=
5585029220pygments-n" style=3D"font-family:monospace;white-space:pre-wrap;b=
ackground-color:rgb(255,255,255)">s</span><span class=3D"m_7236857695585029=
220pygments-p" style=3D"font-family:monospace;white-space:pre-wrap;backgrou=
nd-color:rgb(255,255,255)">)+1)</span><span class=3D"m_7236857695585029220p=
ygments-p" style=3D"font-family:monospace;white-space:pre-wrap;background-c=
olor:rgb(255,255,255)">;</span></div><div><span class=3D"m_7236857695585029=
220pygments-p" style=3D"font-family:monospace;white-space:pre-wrap;backgrou=
nd-color:rgb(255,255,255)"><br></span></div><div><font face=3D"monospace"><=
span style=3D"background-color:rgb(255,255,255)"><span style=3D"white-space=
:pre-wrap">We found this using static analysis using CodeSonar. I don=E2=80=
=99t have an actual path that will demonstrate this bug.</span></span></fon=
t></div><div><br></div><div>Regards,</div><div>Mark</div><div><br><div>
<div style=3D"color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-=
indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wra=
p:break-word"><div style=3D"color:rgb(0,0,0);letter-spacing:normal;text-ali=
gn:start;text-indent:0px;text-transform:none;white-space:normal;word-spacin=
g:0px;word-wrap:break-word"><div style=3D"color:rgb(0,0,0);letter-spacing:n=
ormal;text-align:start;text-indent:0px;text-transform:none;white-space:norm=
al;word-spacing:0px;word-wrap:break-word"><div style=3D"color:rgb(0,0,0);le=
tter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;wh=
ite-space:normal;word-spacing:0px;word-wrap:break-word"><div style=3D"color=
:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-tra=
nsform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div =
style=3D"color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-inden=
t:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:bre=
ak-word"><div style=3D"color:rgb(0,0,0);letter-spacing:normal;text-align:st=
art;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px=
;word-wrap:break-word"><div style=3D"color:rgb(0,0,0);letter-spacing:normal=
;text-align:start;text-indent:0px;text-transform:none;white-space:normal;wo=
rd-spacing:0px;word-wrap:break-word"><div style=3D"word-wrap:break-word"><d=
iv style=3D"color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-styl=
e:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;=
text-align:start;text-indent:0px;text-transform:none;white-space:normal;wor=
d-spacing:0px">=E2=80=94</div><span class=3D"HOEnZb"><font color=3D"#888888=
"><div style=3D"color:rgb(0,0,0);font-family:Helvetica;font-size:12px;font-=
style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:nor=
mal;text-align:start;text-indent:0px;text-transform:none;white-space:normal=
;word-spacing:0px">Mark Hermeling |=C2=A0<b>Gramma<font color=3D"#d72332">T=
ech</font></b>=C2=A0| Senior Director Product Marketing<br>mobile <a href=
=3D"tel:(607)%20351-5719" value=3D"+16073515719" target=3D"_blank">+1 (607)=
 351-5719</a> | <a href=3D"http://www.grammatech.com" target=3D"_blank">www=
.grammatech.com</a></div><div style=3D"color:rgb(0,0,0);font-family:Helveti=
ca;font-size:12px;font-style:normal;font-variant-caps:normal;font-weight:no=
rmal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:=
none;white-space:normal;word-spacing:0px"><br></div><br class=3D"m_72368576=
95585029220Apple-interchange-newline"></font></span></div></div><br class=
=3D"m_7236857695585029220Apple-interchange-newline"></div><br class=3D"m_72=
36857695585029220Apple-interchange-newline"></div><br class=3D"m_7236857695=
585029220Apple-interchange-newline"></div><br class=3D"m_723685769558502922=
0Apple-interchange-newline"></div><br class=3D"m_7236857695585029220Apple-i=
nterchange-newline"></div><br class=3D"m_7236857695585029220Apple-interchan=
ge-newline"></div><br class=3D"m_7236857695585029220Apple-interchange-newli=
ne"></div><br class=3D"m_7236857695585029220Apple-interchange-newline"><br =
class=3D"m_7236857695585029220Apple-interchange-newline">
</div>
<br></div></div><br>______________________________<wbr>_________________<br=
>
Bug-gnu-chess mailing list<br>
<a href=3D"mailto:[email protected]">[email protected]</a><br>
<a href=3D"https://lists.gnu.org/mailman/listinfo/bug-gnu-chess" rel=3D"nor=
eferrer" target=3D"_blank">https://lists.gnu.org/mailman/<wbr>listinfo/bug-=
gnu-chess</a><br>
<br></blockquote></div><br></div>

--94eb2c08233403244a05535cf8a5--


--===============7122252128979603421==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Bug-gnu-chess mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/bug-gnu-chess

--===============7122252128979603421==--