beacon crashes if the length of the destination exceeds 20

[Andreas Schantin]

Binary package hint: ax25-tools

The beacon tool crashes if the length of the -d parameter (destination calls and digipeater path) exceeds a length of 20 characters. This seems to happen because the destination path (char *destcall) is copied into addr (char addr[20]) without checking the length. See lines 106 of beacon.c:

...
105 else if (destcall != NULL)
106 strcpy(addr, destcall);
...

Checking the length of destcall before copying should solve the problem:

 if (strlen(destcall) > 20) {
  fprintf(stderr, "beacon: destination (-d) exceeds allowed length\n");
  return 1;
 } else
 strcpy(addr, destcall);

I'd also propose to increase the length of addr a little since 20 characters seems a little few for longer pathes.

[Santana (rigosantana3-gmx)]

Report is decriptive enogh to go to dev. This is not really a "bug" but rather an oversight.

[Andreas Schantin (andreas-schantin)]

The official (?) site of the ax25-tools http://www.linux-ax25.org/wiki/LinuxAX25 shows that this was already fixed:
http://www.linux-ax25.org/cvsweb/ax25-tools/ax25/beacon.c
Maybe ax25-tools just needs to be repackeged.

[Kamal Mostafa (kamalmostafa)]

I have created a PPA update packages for Karmic and Lucid which include the fix for this bug, cherry-picked from upstream (http://www.linux-ax25.org/cvsweb/ax25-tools/ax25/beacon.c) version ax25_tools_0_0_10_rc1:

    https://launchpad.net/~kamalmostafa/+archive/ax25-tools-fixes

[Launchpad Janitor (janitor)]

This bug was fixed in the package ax25-tools - 0.0.8-13.1ubuntu1

---------------
ax25-tools (0.0.8-13.1ubuntu1) lucid; urgency=low

  * Fix beacon -d <longstring> crash (LP: #353219):
    - Cherry-pick fix from upstream ax25_tools_0_0_10_rc1 (www.linux-ax25.org):
      ax25/beacon.c (CVS rev 1.2): important security fix:
        char addr[20] was static and strcpy(addr,.argv[n]) of variable length.
 -- Kamal Mostafa <email address hidden> Tue, 02 Feb 2010 11:36:32 -0800

[Kamal Mostafa (kamalmostafa)]

Patch has been forwarded upstream to Debian.