NetBSD Problem Report #60940

From www@netbsd.org  Thu Oct 29 23:20:08 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 63B281A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 29 Oct 2026 23:20:08 +0000 (UTC)
Message-Id: <20261029232007.35C331A923C@mollari.NetBSD.org>
Date: Thu, 29 Oct 2026 23:20:07 +0000 (UTC)
From: kilian.feess@posteo.de
Reply-To: kilian.feess@posteo.de
To: gnats-bugs@NetBSD.org
Subject: atto: snprintf into b_bname passes NAME_MAX, aborts under _FORTIFY_SOURCE
X-Send-Pr-Version: www-1.0
X-From4GNATS: "kilian.feess@posteo.de via gnats" <gnats-admin@NetBSD.org>

>Number:         60940
>Category:       bin
>Synopsis:       atto: snprintf into b_bname passes NAME_MAX, aborts under _FORTIFY_SOURCE
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 29 23:25:00 +0000 2026
>Originator:     Kilian Feess
>Release:        NetBSD github mirror, commit 7a4ec9b (NetBSD-current (11.99.9), src/usr.bin/atto as of 2026-10-30)
>Organization:
>Environment:
Linux CelsiusM770 7.0.0-42-generic #42-Ubuntu SMP PREEMPT_DYNAMIC Thu Oct 15 08:06:44 UTC 2026 x86_64 GNU/Linux

>Description:
When starting atto without args the scratch buffer is named
snprintf(curbp->b_bname, NAME_MAX, "*scratch*");

b_bname is char[STRBUF_S], STRBUF_S is 16 bytes, but NAME_MAX is 255

I built the source on Ubuntu 26.04 which enables _FORTIFY_SOURCE by default. This crashed the program.

Upstream atto uses strncpy(curbp->b_bname, "*scratch*", STRBUF_S) and thus does not have this bug.
>How-To-Repeat:
On a glibc system, build usr.bin/atto with -O2 -D_FORTIFY_SOURCE=2 (or with Ubuntu's default gcc), then run atto with no arguments. It aborts immediately.
>Fix:
diff --git a/usr.bin/atto/main.c b/usr.bin/atto/main.c
--- a/usr.bin/atto/main.c
+++ b/usr.bin/atto/main.c
@@ -76,7 +76,7 @@ int main(int argc, char **argv)
                }
        } else {
                curbp = find_buffer("*scratch*", TRUE);
-               snprintf(curbp->b_bname, NAME_MAX, "*scratch*");
+               snprintf(curbp->b_bname, sizeof(curbp->b_bname), "*scratch*");
        }

Home	PR Database Search