guaranteed crash on completion of puzzle

[Seth]

Binary package hint: xjig

There is a buffer overrun leading to memory corruption crashing xjig on completion of the puzzle. Attached is a patch. I tried reporting this to 'upstream' but I have reason to believe the original developer might no longer be alive. That's what happens to truly venerable programs, I guess: they live to survive their authors.

I would much appreciate it if we can at least fix it for debian/ubuntu users. Here is the mail I (tried to) sent to Helmuth verbatim:

--------------------

Subject xjig 2.4
Sender <email address hidden>
Recipient <email address hidden>
Date 19.03.2011 20:59

 Hi Helmuth,

 nice work! I just compiled your project to get the kids some mouse exercise (3yrs and 5yrs). Big fun.

 I want to report the following patch against xjig.C (2.4 tarball from ftp://ftp.x.org//contrib/games/)

diff --git a/xjig.C b/xjig.C
index b02c116..8f8cecd 100644
--- a/xjig.C
+++ b/xjig.C
@@ -682,7 +682,7 @@ Pixmap pixmap;
                                current_time = GetCurrentTime();
                                // printf( "%g\n", current_time );
                                if ((unsigned long)current_time>next_sec) {
- char buffer[20];
+ char buffer[50];
                                        next_sec = (unsigned long)current_time;
                                        if (!p->Finished()) {
                                                sprintf( buffer, "xpuzzle: %02ld:%02ld",

 No rocket science to find it, but hey - but it gave a guaranteed buffer overflow every successful completion :)
 I think that means that no-one ever solved a puzzle from xjig since 1996 ? Or perhaps, this bug was the puzzle.

 Anyhow, thanks for a great sample program and kid toy,

 Seth Heeren

[cloonfane (les-webmayo)]

Hi Seth,
The code you quote there is not in any of the versions I have.
Also, I have completed hundreds of xjig puzzles over the last few years,
and never a crash.

I now use version 2.5 ( http://sourceforge.net/projects/xjig/ ). It has
more options, and a frontend manager.

Regards
Les Hardy

[Seth (bugs-sehe)]

On 05/24/2011 07:18 PM, cloonfane wrote:
> Hi Seth,
> The code you quote there is not in any of the versions I have.
> Also, I have completed hundreds of xjig puzzles over the last few years,
> and never a crash.
>
> I now use version 2.5 ( http://sourceforge.net/projects/xjig/ ). It has
> more options, and a frontend manager.
>
> Regards
> Les Hardy
Ok, you are obviously referring to some other package that I'm not
currently aware of.
That's funny. I just reinstalled in Ubuntu Maverick Meerkat - and it
still crashes every time I finish the puzzle.

Note that the crash might not manifest itself with different
versions/builds of libraries or on (e.g.) AMD64

Here are the details, in case it helps pinpointing our version mismatch:

    sehe@meerkat:/$ which xjig
    /usr/games/xjig

    sehe@meerkat:/$ dpkg --search /usr/games/xjig
    xjig: /usr/games/xjig

    sehe@meerkat:/$ dpkg --status xjig
    Package: xjig
    Status: install ok installed
    Priority: optional
    Section: games
    Installed-Size: 276
    Maintainer: Ubuntu Developers <email address hidden>
    Architecture: i386
    Version: 2.4-13
    Depends: libc6 (>= 2.7), libgcc1 (>= 1:4.1.1), libjpeg62,
    libnetpbm10, libstdc++6 (>= 4.1.1), libx11-6, libxext6
    Description: An X11 jigsaw puzzle
     xjig is a puzzle that tries to replicate a jigsaw puzzle on the screen
     as closely as possible. Any GIF, JPEG or PPM image may be loaded
    and cut
     into pieces. The goal (as with any jigsaw puzzle) is to reassemble the
     original picture.
     .
     Tiles may be freely rotated by use of the mouse, flipped (for
     double-sided puzzles) and even shown as shaped windows on the desktop
     (fast machine/video card recommended for the latter!). An example image
     is provided in /usr/share/games/xjig .
    Original-Maintainer: Dave Holland <email address hidden>

Trace

    sehe@meerkat:/$ xjig -w 2 -h 2 -no_flip

    xjig V2.4, by Helmut Hoenig, July-24-96

    *** buffer overflow detected ***: xjig terminated
    ======= Backtrace: =========
    /lib/libc.so.6(__fortify_fail+0x50)[0xb7582970]
    /lib/libc.so.6(+0xe486a)[0xb758186a]
    /lib/libc.so.6(+0xe3fa8)[0xb7580fa8]
    /lib/libc.so.6(_IO_default_xsputn+0x9e)[0xb7507a2e]
    /lib/libc.so.6(_IO_vfprintf+0x115)[0xb74da325]
    /lib/libc.so.6(__vsprintf_chk+0xad)[0xb758105d]
    /lib/libc.so.6(__sprintf_chk+0x2d)[0xb7580f9d]
    xjig[0x804c9d8]
    /lib/libc.so.6(__libc_start_main+0xe7)[0xb74b3ce7]
    xjig[0x804a4e1]

I can very much see the line with the problem right there: xjig.C

    685 char buffer[20];
    686 next_sec = (unsigned long)current_time;
    687 if (!p->Finished()) {
    688 sprintf( buffer, "xpuzzle: %02ld:%02ld",
    689 next_sec / 60, next_sec % 60 );
    690 if (!shapes) XStoreName(dpy,win,buffer);
    691 }
    692 else {
    693 sprintf( buffer, "no more tiles left at: %02ld:%02ld",
    694 next_sec / 60, next_sec % 60 );

I'm on

    sehe@meerkat:/tmp/xjig-2.4$ uname -a
    Linux meerkat 2.6.35-28-generic-pae #50-Ubuntu SMP Fri Mar 18
    20:43:15 UTC 2011 i686 GNU/Linux
    sehe@meerkat:/tmp/x...

[cloonfane (les-webmayo)]

@Seth, your right, there was something different on my system.

I uninstalled version 2.5.3 and installed 2.4.13, and still could not reproduce the bug, and then I got to thinking, I was using xjigmanager, not the shell.

I tried from the shell, and yes, a crash every time. I can't think why it doesn't crash from the xjigmanager.
Anyway, I'm going back to 2.5 now.

les@les-Inspiron-N5010:~$ dpkg --status xjig
Package: xjig
Status: install ok installed
Priority: optional
Section: games
Installed-Size: 276
Maintainer: Ubuntu Developers <email address hidden>
Architecture: i386
Version: 2.4-13
Depends: libc6 (>= 2.7), libgcc1 (>= 1:4.1.1), libjpeg62, libnetpbm10, libstdc++6 (>= 4.1.1), libx11-6, libxext6
Description: An X11 jigsaw puzzle
 xjig is a puzzle that tries to replicate a jigsaw puzzle on the screen
 as closely as possible. Any GIF, JPEG or PPM image may be loaded and cut
 into pieces. The goal (as with any jigsaw puzzle) is to reassemble the
 original picture.
 .
 Tiles may be freely rotated by use of the mouse, flipped (for
 double-sided puzzles) and even shown as shaped windows on the desktop
 (fast machine/video card recommended for the latter!). An example image
 is provided in /usr/share/games/xjig .
Original-Maintainer: Dave Holland <email address hidden>

les@les-Inspiron-N5010:~$ xjig -file "Pictures/Jigsaw Images/castle-maintenon.jpg" -w 2 -h 2 -no_flip

xjig V2.4, by Helmut Hoenig, July-24-96

*** buffer overflow detected ***: xjig terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x50)[0xb73f8970]
/lib/libc.so.6(+0xe486a)[0xb73f786a]
/lib/libc.so.6(+0xe3fa8)[0xb73f6fa8]
/lib/libc.so.6(_IO_default_xsputn+0x9e)[0xb737da2e]
/lib/libc.so.6(_IO_vfprintf+0x115)[0xb7350325]
/lib/libc.so.6(__vsprintf_chk+0xad)[0xb73f705d]
/lib/libc.so.6(__sprintf_chk+0x2d)[0xb73f6f9d]
xjig[0x804c9d8]
/lib/libc.so.6(__libc_start_main+0xe7)[0xb7329ce7]
xjig[0x804a4e1]
======= Memory map: ========
08048000-08061000 r-xp 00000000 08:01 4726875 /usr/games/xjig
08061000-08062000 r--p 00018000 08:01 4726875 /usr/games/xjig
08062000-08063000 rw-p 00019000 08:01 4726875 /usr/games/xjig
08063000-0806b000 rw-p 00000000 00:00 0
0938c000-093ce000 rw-p 00000000 00:00 0 [heap]
b66c0000-b6ee0000 rw-p 00000000 00:00 0
b703e000-b72e7000 rw-s 00000000 00:04 23363615 /SYSV00000000 (deleted)
b72e7000-b72ea000 rw-p 00000000 00:00 0
b72ea000-b72ee000 r-xp 00000000 08:01 4721420 /usr/lib/libXdmcp.so.6.0.0
b72ee000-b72ef000 r--p 00003000 08:01 4721420 /usr/lib/libXdmcp.so.6.0.0
b72ef000-b72f0000 rw-p 00004000 08:01 4721420 /usr/lib/libXdmcp.so.6.0.0
b72f0000-b72f2000 r-xp 00000000 08:01 4721409 /usr/lib/libXau.so.6.0.0
b72f2000-b72f3000 r--p 00001000 08:01 4721409 /usr/lib/libXau.so.6.0.0
b72f3000-b72f4000 rw-p 00002000 08:01 4721409 /usr/lib/libXau.so.6.0.0
b72f4000-b72f6000 r-xp 00000000 08:01 281168 /lib/libdl-2.12.1.so
b72f6000-b72f7000 r--p 00001000 08:01 281168 /lib/libdl-2.12.1.so
b72f7000-b72f8000 rw-p 00002000 08:01 281168 /lib/libdl-2.12.1.so
b72f8000-b7310000 r-xp 00000000 08:01 4722371 /usr/lib/libxcb.so.1.1.0
b7310000-b7311000 r--p 00017000 08:01 4722371 /usr/lib/libxcb.s...

[Launchpad Janitor (janitor)]

This bug was fixed in the package xjig - 2.4-14.1

---------------
xjig (2.4-14.1) unstable; urgency=low

  * NMU (Closes: #886455).
  * Added icon (xjig.xpm) and keywords field to desktop file
    (Closes: #738068).
  * Switch to two desktop files: xjig and xjig-random.
  * Removed article on debian/control Description field.
  * Migrated to Standards-Version 4.1.3.
    + Added debian/compat file.
    + Debhelper and compat level to 10.
    + Added debian/source/format file.
    + Added ${misc:Depends} on debian/control Depends field.
    + Rewrote debian/rules with dh $@ (Closes: #777355).
      Added dir, install and manpages debian files.
  * Added debian/watch file (xjig
    does not have an active web address).
  * Added 2 patches to fix typo errors on source code.
  * Removed debian/menu file.
    - Removed postinst, postrm and prerm debian files.
  * Added patch to simulate an initial "End" keypress to
    bring all pieces into view (Closes: #417916).
  * Converted debian/copyright to DEP-5.
  * Modified the xjig-random patch to add a file extension filter
    and home pictures directory.
  * Added patch (by Seth Heeren) to prevent crash on
    completion of puzzle (LP: #787035).
  * Added patch (by Alan Curry) to prevent beeps on completing
    (Closes: #610122).

 -- Innocent De Marchi <email address hidden> Tue, 27 Mar 2018 18:29:25 +0200