Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-03 Thread Jerome BENOIT
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello All, I have just deposited a minimal fix at Alioth (unstable/master branch). Thanks for the reports, the patches, and the comments. Jerome On 03/03/15 16:48, Moritz Muehlenhoff wrote: > On Tue, Mar 03, 2015 at 08:13:12AM +0100, Jerome BENOIT

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-03 Thread Moritz Muehlenhoff
On Tue, Mar 03, 2015 at 08:13:12AM +0100, Jerome BENOIT wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Hello All, > > The patch was committed by the upstream maintainer [1]. > He is also currently working on the print issue. > Once solved, he may release a new version for BibTool. >

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Jerome BENOIT
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello All, The patch was committed by the upstream maintainer [1]. He is also currently working on the print issue. Once solved, he may release a new version for BibTool. On the other hand, the bug was downgraded from RC to Grave. I will package thi

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Vincent Lefevre
On 2015-03-02 16:35:51 +0100, Jerome BENOIT wrote: > Thanks, it sounds helpful: I have just forwarded your last tow email > to the mainstream maintainer: let wait for his feedback. I've attached a patch for this bug. I've also added a new test that triggers another heap buffer overflow (this is b

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Jerome BENOIT
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thanks, it sounds helpful: I have just forwarded your last tow email to the mainstream maintainer: let wait for his feedback. Jerome On 02/03/15 16:27, Vincent Lefevre wrote: > On 2015-03-02 16:10:43 +0100, Vincent Lefevre wrote: >> rewrite.c:313 is:

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Vincent Lefevre
On 2015-03-02 16:10:43 +0100, Vincent Lefevre wrote: > rewrite.c:313 is: > > stack[stackp++] = field; > > With the context: > > if ( stackp > stacksize ) /* > */ > { stacksize += 8; /* > *

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Vincent Lefevre
Package: bibtool Version: 2.57+ds-2 Severity: grave Tags: security upstream Justification: causes non-serious data loss As I get random output corruption (see bug 747519) and valgrind errors, I tried to rebuild the package with: DEB_CFLAGS_APPEND="-fsanitize=address" debuild -i -us -uc -b but