Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Vincent Lefevre
On 2015-03-02 16:35:51 +0100, Jerome BENOIT wrote: > Thanks, it sounds helpful: I have just forwarded your last tow email > to the mainstream maintainer: let wait for his feedback. I've attached a patch for this bug. I've also added a new test that triggers another heap buffer overflow (this is b

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Jerome BENOIT
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thanks, it sounds helpful: I have just forwarded your last tow email to the mainstream maintainer: let wait for his feedback. Jerome On 02/03/15 16:27, Vincent Lefevre wrote: > On 2015-03-02 16:10:43 +0100, Vincent Lefevre wrote: >> rewrite.c:313 is:

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Vincent Lefevre
On 2015-03-02 16:10:43 +0100, Vincent Lefevre wrote: > rewrite.c:313 is: > > stack[stackp++] = field; > > With the context: > > if ( stackp > stacksize ) /* > */ > { stacksize += 8; /* > *

Bug#779573: bibtool: heap buffer overflow in the bibtool tests

2015-03-02 Thread Vincent Lefevre
Package: bibtool Version: 2.57+ds-2 Severity: grave Tags: security upstream Justification: causes non-serious data loss As I get random output corruption (see bug 747519) and valgrind errors, I tried to rebuild the package with: DEB_CFLAGS_APPEND="-fsanitize=address" debuild -i -us -uc -b but