NetBSD Problem Report #60943

From www@netbsd.org  Fri Oct 30 01:06:59 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 635FE1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 30 Oct 2026 01:06:59 +0000 (UTC)
Message-Id: <20261030010658.4E0661A923C@mollari.NetBSD.org>
Date: Fri, 30 Oct 2026 01:06:58 +0000 (UTC)
From: kilian.feess@posteo.de
Reply-To: kilian.feess@posteo.de
To: gnats-bugs@NetBSD.org
Subject: atto: format string injection (replace.c:49)
X-Send-Pr-Version: www-1.0
X-From4GNATS: "kilian.feess@posteo.de via gnats" <gnats-admin@NetBSD.org>

>Number:         60943
>Category:       bin
>Synopsis:       atto: format string injection (replace.c:49)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 30 01:10:00 +0000 2026
>Originator:     Kilian Feess
>Release:        NetBSD-current version 11.99.9
>Organization:
>Environment:
Linux CelsiusM770 7.0.0-42-generic #42-Ubuntu SMP PREEMPT_DYNAMIC Thu Oct 15 08:06:44 UTC 2026 x86_64 GNU/Linux

>Description:
format string injection in replace.c

replace.c:39
snprintf(question, sizeof(question), "Replace '%s' with '%s' ? ", searchtext, replace);

replace.c:41
msg(question);

If searchtext or replace contain format strings, they are executed in msg.

Second issue:
main.c:126 msg()
It applies an unbounded vsprintf - a format string like %999d would write ~10kb of data

Upstream is affected, too.

These reports I sent were the most significant bugs. There are some smaller ones left. I would recommend to use an LLM and ask something like "do a security audit of this code base and make a list of your findings" to weed the rest out.

I found the first issue when building and running the editor on Linux to try it out, the default setting of _FORTIFY_SOURCE and decided to dig for more issues.
>How-To-Repeat:
./atto
%x # type %x move cursor to the front of the line
# Esc-r
# replace %x [enter] with %p
# you should see some stack contents
>Fix:
change replace.c:41 to

msg("%s", question);

and main.c:130 to

(void) vsnprintf(msgline, sizeof(msgline), msg, args);

Home	PR Database Search