[bug] Parameter parsing in gst-tool.c can cause out of bounds reads

Hanno Böck <[email protected]>
Newsgroups gmane.comp.lang.smalltalk.gnu.general
Message-ID <type=project&nid=1006&[email protected]>
Issue status update for 
http://smalltalk.gnu.org/node/1006
Post a follow up: 
http://smalltalk.gnu.org/project/comments/add/1006

 Project:      GNU Smalltalk
 Version:      <none>
 Component:    Build
 Category:     bug reports
 Priority:     normal
 Assigned to:  Unassigned
 Reported by:  hanno
 Updated by:   hanno
 Status:       active

In gst-tool.c there is a loop that compares a given long option with the
available long options. It uses a memcmp call for that with the length
of the given option.
This will cause out of bounds heap reads (that can be detected with
address sanitizer), because many of the available options will be
shorter than a given option.

Changing memcmp to strncmp corrects this bug and will avoid reading the
option strings beyond a terminating zero. See attached patch. This patch
is against the latest test version 3.2.91.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.