Re: Buffer overflow in the StringQuotedWord() function
William Bader <[email protected]> Wed, 21 Oct 2020 03:37:15 +0000
| Newsgroups | gmane.comp.type-setting.lout |
|---|---|
| Message-ID | <DB6PR0201MB2471311D0919818A2B71D1A4C41C0@DB6PR0201MB2471.eurprd02.prod.outlook.com> |
--_000_DB6PR0201MB2471311D0919818A2B71D1A4C41C0DB6PR0201MB2471_ Content-Type: text/plain; charset="windows-1250" Content-Transfer-Encoding: quoted-printable I have active projects that use lout, and my diff file of small fixes and e= nhancement to lout-3.40 is now over 1300 lines. Would it be possible to find a home for the 3.40 source on github or https:= //www.freedesktop.org/wiki/ so that patches can at least be posted as issue= s even if there is never another release? Someone posted 3.39 as https://github.com/thektulu/lout Someone posted some data fixes as https://github.com/EPadronU/lout github has some other projects called lout, but I think that they are for L= ogging OUTput of web apps. Has anyone looked at the memory issues? StringQuotedWord lout-3.40/z39.c:254:66 looks easy to fix by checking that = q < &buf[MAX_BUF-2] in the loop. srcnext lout-3.40/z02.c:381:26 is more complicated. Does it have to check t= hat limit > mem_block? Regards, William ________________________________ From: Lout-users <[email protected]>= on behalf of Jeffrey Kingston <[email protected]> Sent: Tuesday, October 20, 2020 7:52 PM To: Mat=ECj Cepl <[email protected]> Cc: [email protected] <[email protected]> Subject: Re: Buffer overflow in the StringQuotedWord() function > Is anyone still maintaining lout? I'm still around but I see little point in making new versions of Lout at this late stage. So I guess I'm saying that I'm not maintaining Lout any longer. If something serious turned up I suppose I would gird my loins and fix it, but that's very unlikely. Jeff Kingston ________________________________ From: Lout-users on behalf of Mat=ECj Cepl Sent: Wednesday, October 21, 2020 2:20 AM To: William Bader; Frederic Cambus; [email protected] Subject: Re: Buffer overflow in the StringQuotedWord() function William Bader p=ED=9Ae v So 21. 12. 2019 v 11:59 +0000: > Is anyone still maintaining lout? That=92s the question, isn=92t it? We have in OpenSUSE still two opened CVEs (https://bugzilla.suse.com/1159713 and https://bugzilla.suse.com/1159714), Debian just removed lout from its archive (https://bugs.debian.org/972182). Is the project finally dead, and should I remove the package from OpenSUSE as well (and Fedora, where I am a maintainer too)? Best, Mat=ECj Cepl -- https://matej.ceplovi.cz/blog/, Jabber: [email protected] GPG Finger: 3C76 A027 CA45 AD70 98B5 BC1D 7920 5802 880B C9D8 This message has been composed of recycled electrons. None of these electrons has been harmed or injured in the creation and transmission of this message but they have been shamelessly exploited for this use. --_000_DB6PR0201MB2471311D0919818A2B71D1A4C41C0DB6PR0201MB2471_ Content-Type: text/html; charset="windows-1250" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-1= 250"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> I have active projects that use lout, and my diff file of small fixes and e= nhancement to lout-3.40 is now over 1300 lines.</div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> Would it be possible to find a home for the 3.40 source on github or <= a href=3D"https://www.freedesktop.org/wiki/" id=3D"LPlnk">https://www.freed= esktop.org/wiki/</a> so that patches can at least be posted as issues = even if there is never another release?</div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> Someone posted 3.39 as <a href=3D"https://github.com/thektulu/lout" id= =3D"LPlnk">https://github.com/thektulu/lout</a></div> <div class=3D"_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_= 1"></div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> Someone posted some data fixes as <a href=3D"https://github.com/EPadro= nU/lout" id=3D"LPlnk">https://github.com/EPadronU/lout</a></div> <div class=3D"_Entity _EType_OWALinkPreview _EId_OWALinkPreview_1 _EReadonl= y_1"></div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> github has some other projects called lout, but I think that they are for L= ogging OUTput of web apps.</div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> Has anyone looked at the memory issues?</div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> StringQuotedWord lout-3.40/z39.c:254:66 looks easy to fix by checking that = q < &buf[MAX_BUF-2] in the loop.<br> </div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> srcnext lout-3.40/z02.c:381:26 is more complicated. Does it have to check t= hat limit > mem_block?<br> </div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <span style=3D"color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-s= erif; font-size: 12pt;">Regards, William</span><br> </div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <br> </div> <div> <hr tabindex=3D"-1" style=3D"display:inline-block; width:98%"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" co= lor=3D"#000000" style=3D"font-size:11pt"><b>From:</b> Lout-users <lout-u= [email protected]> on behalf of Jeffrey= Kingston <[email protected]><br> <b>Sent:</b> Tuesday, October 20, 2020 7:52 PM<br> <b>To:</b> Mat=ECj Cepl <[email protected]><br> <b>Cc:</b> [email protected] <[email protected]><br> <b>Subject:</b> Re: Buffer overflow in the StringQuotedWord() function</fon= t> <div> </div> </div> <div dir=3D"ltr"> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <font size=3D"2"><span style=3D"font-size:11pt">> Is anyone still mainta= ining lout?</span></font></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> I'm still around but I see little point in making new versions of Lout</div= > <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> at this late stage. So I guess I'm saying that I'm not maintaining</d= iv> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Lout any longer. If something serious turned up I suppose I</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> would gird my loins and fix it, but that's very unlikely.</div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> Jeff Kingston<br> </div> <div> <div><br> </div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> <hr tabindex=3D"-1" style=3D"display:inline-block; width:98%"> <b>From:</b> Lout-users on behalf of Mat=ECj Cepl<br> <b>Sent:</b> Wednesday, October 21, 2020 2:20 AM<br> <b>To:</b> William Bader; Frederic Cambus; [email protected]<br> <b>Subject:</b> Re: Buffer overflow in the StringQuotedWord() function <div><br> </div> </div> <div class=3D"x_BodyFragment"><font size=3D"2"><span style=3D"font-size:11p= t"> <div class=3D"x_PlainText">William Bader p=ED=9Ae v So 21. 12. 2019 v 11:59= +0000:<br> > Is anyone still maintaining lout?<br> <br> That=92s the question, isn=92t it? We have in OpenSUSE still two <br> opened CVEs (https://bugzilla.suse.com/1159713 and<br> <a href=3D"https://bugzilla.suse.com/1159714" target=3D"_blank" rel=3D"noop= ener noreferrer">https://bugzilla.suse.com/1159714</a>), Debian just remove= d lout <br> from its archive (<a href=3D"https://bugs.debian.org/972182" target=3D"_bla= nk" rel=3D"noopener noreferrer">https://bugs.debian.org/972182</a>).<br> <br> Is the project finally dead, and should I remove the package <br> from OpenSUSE as well (and Fedora, where I am a maintainer too)?<br> <br> Best,<br> <br> Mat=ECj Cepl<br> <br> -- <br> <a href=3D"https://matej.ceplovi.cz/blog/" target=3D"_blank" rel=3D"noopene= r noreferrer">https://matej.ceplovi.cz/blog/</a>, Jabber: [email protected]<= br> GPG Finger: 3C76 A027 CA45 AD70 98B5 BC1D 7920 5802 880B C9D8<br> <br> This message has been composed of recycled electrons. None of<br> these electrons has been harmed or injured in the creation and<br> transmission of this message but they have been shamelessly<br> exploited for this use.<br> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <br> </div> </div> </div> </div> </span></font></div> </div> </div> </div> </body> </html> --_000_DB6PR0201MB2471311D0919818A2B71D1A4C41C0DB6PR0201MB2471_--