multiple stack overflows

[Kees Cook]

Binary package hint: tracker

At least two stack overflows are present. While not an issue in Ubuntu (due to stack protections), these could cause crashes, and generally need to be fixed:

    src/text-filters/ooo_converter/o3read.c
        line 203: unbounded copy across stack? might destroy q... (but it isn't used for later overwrites)

    src/tracker-thumbnailer/tracker-thumbnailer.c:
        line 145: bug; 1 byte NULL-overwrite (uri_hash is 20 chars long, needs 21)

[Jamie McCracken (jamiemcc-blueyonder)]

inlined O3read has been removed from tracker - it now uses the system one which is in main repo

I will investigate the tracker-thumbnailer.c one though

[Kees Cook (kees)]

Just for note, I realize "line 203" isn't useful without mentioning version (0.0.4-1 o3read), but the line is:

         while (*q && !isspace(*q)) b[n++] = toupper(*q++);

Strings longer than 1024 (without spaces) will cause this loop to walk past the end of "b". Checking "n" should solve the issue.

[Emilio Pozuelo Monfort (pochu)]

Michael was working on this.

[Emilio Pozuelo Monfort (pochu)]

No, he wasn't. I mixed up this report and the tempfile usage one.

[Jamie McCracken (jamiemcc-blueyonder)]

Fixed the potential stack overflow in tracker source

[Launchpad Janitor (janitor)]

This bug was fixed in the package tracker - 0.6.4-1ubuntu2

---------------
tracker (0.6.4-1ubuntu2) hardy; urgency=low

  * debian/tracker.py:
    - Added an apport hook to ignore tracker-extract crashes, since they
      are caused by setrlimit terminating tracker-extract when it raises
      it's cpu/memory limit.
  * debian/tracker.install:
    - Install tracker.py in /usr/share/apport/package-hooks/
  * debian/patches/07_disable_xmp_metadata_extracting.patch:
    - Disable xmp metadata extraction for now, as it's buggy and is causing
      tracker-extract to get stuck indexing the same file.
      Patch backported from trunk. LP: #194221.
  * debian/patches/08_fix_potential_stack_overflow.patch:
    - Fix a potential stack overflow, backported from trunk. LP: #164150.

 -- Emilio Pozuelo Monfort <email address hidden> Mon, 25 Feb 2008 09:46:41 +0100

[Thomas Hotz (thotz-deactivatedaccount)]

Any update on the stack overflow in o3read? Thank you for telling us!

[Phillip Susi (psusi)]

Closing this task since the o3read package no longer exists.