Arch Linux

Anakievs

Member

Registered: 2023-06-12

Posts: 20

dhex is broken in the repos (buffer overflow, core dump)

Searching a string in dhex results in buffer overflow. To reproduce: install dhex, open a single file, press F2 for search, navigate to "Searchstring (asc):", press Enter and type something. The problem comes from the modified "Makefile", it's fine with the original one (from the source archive). To fix the issue I've replaced all instances of "?="  to "=" in the "Makefile".

While building (without modifications) this appears few times:

In function ‘memcpy’,
    inlined from ‘newMenuItem’ at menu.c:17:2,
    inlined from ‘correlationmask’ at ui.c:156:2:
/usr/include/bits/string_fortified.h:29:10: warning: ‘__builtin_memcpy’ reading 64 bytes from a region of size 11 [-Wstringop-overread]
   29 |   return __builtin___memcpy_chk (__dest, __src, __len,
      |          ^

This problem is quite old but I haven't tried to fix it so far.

Scimmia

Fellow

Registered: 2012-09-01

Posts: 12,723

Re: dhex is broken in the repos (buffer overflow, core dump)

Replacing those means it's ignoring Arch's CFLAGS/LDFLAGS/etc. Many of these are hardening flags, I'd guess the problem is there with the version you built and are a potential security hole, but aren't fatal without the extra hardening.

seth

Member

Registered: 2012-09-03

Posts: 64,179

Re: dhex is broken in the repos (buffer overflow, core dump)

dhex isn't broken in the repos, it's broken in the code.

From the symptom, out of bound access seems unlikely to be deliberate, so this is a bug in dhex that needs to be addressed, eg. by using strncpy instead of memcpy for the posted warning.
Not sure whether it's still maintained, though.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc