forked from marfrit/marfrit-packages
distcc-avahi: fix FORTIFY buffer overflow in dcc_gcc_rewrite_fqn
pkgrel 16 builds ship an upstream distcc 3.4 bug: src/compile.c sizes the rewritten-compiler-name buffer with strlen(argv[0] + 1) — pointer arithmetic applied before strlen — under-allocating by 2 bytes. glibc FORTIFY_SOURCE=2 catches the resulting overflow in strcat and aborts, so every "distcc gcc ..." invocation dies on a modern Arch. Patch moves the +1 outside the strlen, as intended. Closes marfrit/marfrit-packages#3. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,21 @@
|
||||
Description: fix off-by-paren in dcc_gcc_rewrite_fqn buffer sizing
|
||||
src/compile.c's dcc_gcc_rewrite_fqn() allocates a buffer for
|
||||
"<target>-<argv[0]>\0" but writes strlen(argv[0] + 1) — pointer
|
||||
arithmetic *then* strlen, which under-allocates by 2 bytes and trips
|
||||
glibc FORTIFY_SOURCE=2 with "*** buffer overflow detected ***"
|
||||
on any `distcc gcc …` invocation.
|
||||
Intent was strlen(argv[0]) + 1 (length plus terminator).
|
||||
Bug-reauktion: marfrit/marfrit-packages#3
|
||||
Author: Markus Fritsche <mfritsche@reauktion.de>
|
||||
|
||||
--- a/src/compile.c
|
||||
+++ b/src/compile.c
|
||||
@@ -579,7 +579,7 @@ static int dcc_gcc_rewrite_fqn(char **argv)
|
||||
return -ENOENT;
|
||||
|
||||
|
||||
- newcmd_len = strlen(target_with_vendor) + 1 + strlen(argv[0] + 1);
|
||||
+ newcmd_len = strlen(target_with_vendor) + 1 + strlen(argv[0]) + 1;
|
||||
newcmd = malloc(newcmd_len);
|
||||
if (!newcmd)
|
||||
return -ENOMEM;
|
||||
Reference in New Issue
Block a user