* found the actual bug location, in libpano13.
* bug class : unchecked write to fixed size buffer (buffers have hardcoded size)
* hard-coded limits are inconsistent between files (source buffer 65536, destination buffer 256)
* easy to fix ? There is at least the quick-and-easy by increasing lower limit.
## Additional information
It's in libpano13, file panorama.h, line 413 :
#define PANO_PATH_LEN 255
In a nutshell, ParseScript can parse lines up to 65535 characters long, but Image structure only accepts full paths up to 256 characters long.
//Increased so more params can be parsed/optimized (MRDL - March 2002)
#define LINE_LENGTH 65536
Now check im->name.
In ParseScript, im is defined on line 142:
Image *im;
Image type is defined in panorama.h on line 430-355:
struct Image
{
// Pixel data
pt_int32 width;
pt_int32 height;
pt_int32 bytesPerLine;
pt_int32 bitsPerPixel; // Must be 24 or 32
size_t dataSize;
unsigned char **data;
pt_int32 dataformat; // rgb, Lab etc
pt_int32 format; // Projection: rectilinear etc
int formatParamCount; // Number of format parameters.
double formatParam[PANO_PROJECTION_MAX_PARMS]; // Parameters for format.
int precomputedCount; // number of values precomputed for a given pano
double precomputedValue[PANO_PROJECTION_PRECOMPUTED_VALUES]; // to speed up pano creation
double hfov;
double yaw;
double pitch;
double roll;
cPrefs cP; // How to correct the image
char name[PANO_PATH_LEN+1];
PTRect selection;
CropInfo cropInformation; // TO BE DEPRECATED
# Summary
* found the actual bug location, in libpano13.
* bug class : unchecked write to fixed size buffer (buffers have hardcoded size)
* hard-coded limits are inconsistent between files (source buffer 65536, destination buffer 256)
* easy to fix ? There is at least the quick-and-easy by increasing lower limit.
## Additional information
It's in libpano13, file panorama.h, line 413 :
#define PANO_PATH_LEN 255
In a nutshell, ParseScript can parse lines up to 65535 characters long, but Image structure only accepts full paths up to 256 characters long.
## Investigation details
crash log says : 64-linux- gnu/libc. so.6(__ sprintf_ chk+0x7d) [0x2b29d619b22d ] libpano13. so.2(ParseScrip t+0x7f6) [0x2b29d51fe536 ]
/lib/x86_
/usr/lib/
ParseScript is therefore a function in libpano13. 2.9.18+ dfsg/
apt-get source libpano13
cd libpano13-
ParseScript is defined in parser.c.
It calls sprintf on line 448
buf is defined on line 148:
char *li, line[LINE_LENGTH], *ch ,*lineStart, buf[LINE_LENGTH];
buf is big enough to hold a long filename :
//Increased so more params can be parsed/optimized (MRDL - March 2002)
#define LINE_LENGTH 65536
Now check im->name.
In ParseScript, im is defined on line 142:
Image *im;
Image type is defined in panorama.h on line 430-355:
struct Image PANO_PROJECTION _MAX_PARMS] ; // Parameters for format. e[PANO_ PROJECTION_ PRECOMPUTED_ VALUES] ; // to speed up pano creation PATH_LEN+ 1];
{
// Pixel data
pt_int32 width;
pt_int32 height;
pt_int32 bytesPerLine;
pt_int32 bitsPerPixel; // Must be 24 or 32
size_t dataSize;
unsigned char **data;
pt_int32 dataformat; // rgb, Lab etc
pt_int32 format; // Projection: rectilinear etc
int formatParamCount; // Number of format parameters.
double formatParam[
int precomputedCount; // number of values precomputed for a given pano
double precomputedValu
double hfov;
double yaw;
double pitch;
double roll;
cPrefs cP; // How to correct the image
char name[PANO_
PTRect selection;
CropInfo cropInformation; // TO BE DEPRECATED
pano_ ImageMetadata metadata;
};
typedef struct Image Image;
field "name" is on line 455:
char name[PANO_ PATH_LEN+ 1];
PANO_PATH_LEN is defined on panorama.h, line 413:
#define PANO_PATH_LEN 255
Crash is explained.