Bug#792794: tuxmath: buffer overflow strncat

[Aleksei Loginov]

Package: tuxmath
Version: 2.0.3

There is patch from Open Suse in attachment.

diff -ur tuxmath_w_fonts-2.0.3.orig/src/server.c tuxmath_w_fonts-2.0.3/src/server.c
--- tuxmath_w_fonts-2.0.3.orig/src/server.c	2011-05-04 04:15:28.000000000 +0400
+++ tuxmath_w_fonts-2.0.3/src/server.c	2015-07-16 23:11:11.000000000 +0300
@@ -237,11 +237,11 @@
   snprintf(buf, 256, "tuxmathserver ");
   for(i = 1; i < argc; i++)
   {
-    strncat(buf, argv[i], 256);
-    strncat(buf, " ", 256);
+    strncat(buf, argv[i], 255);
+    strncat(buf, " ", 255);
   }
   /* Add '&' to make it non-blocking: */
-  strncat(buf, "&", 256);
+  strncat(buf, "&", 255);
 
   DEBUGMSG(debug_lan, "RunServer_prog() - launching standalone " 
 		  "tuxmathserver program with \"system(%s)\"\n", buf);