Re: Buffer overflow in the StringQuotedWord() function

Dear all,

I'm still around but I am reluctant to change Lout after all this time.  Can
someone prove to me that the issues identified in these emails matter
enough to warrant a new version of a piece of software that has not
changed for years?

Jeff
________________________________
From: Lout-users <[email protected]> on behalf of William Bader <[email protected]>
Sent: Saturday, 21 December 2019 10:59 PM
To: Frederic Cambus <[email protected]>; [email protected] <[email protected]>
Subject: Re: Buffer overflow in the StringQuotedWord() function

Is anyone still maintaining lout?

I have attached patches that fix some graph issues and that add some features.

Is there a consensus how to fix the two overflows that you reported?
The easiest way is probably truncating the buffer and showing a warning, but that might lose text.
Other places in lout might have the same buffer limit, so allocating and passing a larger buffer would take some analysis to ensure that it wouldn't cause a buffer overflow somewhere else.

Regards, William


________________________________
From: Lout-users <[email protected]> on behalf of Frederic Cambus <[email protected]>
Sent: Saturday, December 21, 2019 5:27 AM
To: [email protected] <[email protected]>
Subject: Re: Buffer overflow in the StringQuotedWord() function

On Fri, Dec 20, 2019 at 07:12:14PM +0100, Frederic Cambus wrote:

> While fuzzing lout 3.40 with Honggfuzz, I found a buffer overflow in
> the StringQuotedWord() function, in z39.c.

This issue has been assigned CVE-2019-19917.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19917<https://protect-au.mimecast.com/s/uyn_CZYM2VFkOyJVIzEdnj?domain=cve.mitre.org>