Subject: nx-libs: incorrect usage of scanf

From: Heinrich Schuchardt <[email-masked]>
Date: Fri, 30 Jan 2015 20:35:53 +0100

package: nx-libs
version: head

In different parts of the nx-libs library you can find usages of scanf like

   /* check for MESA_GAMMA environment variable */
   gamma = _mesa_getenv("MESA_GAMMA");
   if (gamma) {
      v->RedGamma = v->GreenGamma = v->BlueGamma = 0.0;
      sscanf( gamma, "%f %f %f", &v->RedGamma, &v->GreenGamma,
&v->BlueGamma );

According to cppcheck:

scanf without field width limits can crash with huge input data on libc
versions older than 2.13-25. Add a field width specifier to fix this
problem:
    %i => %3i

Best regards

Heinrich Schuchardt

---

From: Mike Gabriel <[email-masked]>
Date: Sat, 31 Jan 2015 15:04:21 +0000

Hi Heinrich,

> versions older than 2.13-25. Add a field width specifier to fix this

Any chance you could also provide a patch for this?

Mike

-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: [email-masked], http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

---

From: Heinrich Schuchardt <[email-masked]>
Date: Mon, 02 Feb 2015 21:39:50 +0100

Squeeze reached end of life.
Package libc6 in wheezy is patched against the bug.
Package libc6 in jessie is not vulnerable as it uses a newer libc6
release.

So I think we should close this bug and concentrate on updating our
mesa code to the newest version instead of patching some old version.

Best regards

Heinrich

On 31.01.2015 16:04, Mike Gabriel wrote:
>> package: nx-libs version: head
>> 
>> /* check for MESA_GAMMA environment variable */ gamma =
>> _mesa_getenv("MESA_GAMMA"); if (gamma) { v->RedGamma =
>> v->GreenGamma = v->BlueGamma = 0.0; sscanf( gamma, "%f %f %f",
>> &v->RedGamma, &v->GreenGamma, &v->BlueGamma );
>> 
>> According to cppcheck:
>> 
>> scanf without field width limits can crash with huge input data
>> on libc versions older than 2.13-25. Add a field width specifier
>> to fix this problem: %i => %3i
>

---

From: Mike Gabriel <[email-masked]>
Date: Fri, 15 May 2015 13:11:21 +0000

Control: close -1

Closing (and agreeing on this) by use request.

Mike

-- 

DAS-NETZWERKTEAM

GnuPG Key ID 0x25771B31

freeBusy: