Bug#819337: nethack: crashes during startup in config file parser

[James Cowgill]

Control: tags -1 = confirmed

Hi,

Thanks for the bug report! I've reported it to the Debian BTS for you.
In the future, following the bug reporting procedure is a lot of help.
https://www.debian.org/Bugs/Reporting

When replying, please make sure the bug number (xxx at bugs.debian.org) is
CCed.

On Sat, 2016-03-26 at 23:34 +0000, James Cowgill wrote:
> y at d:~$ uname -a
> Linux d 4.4.0-1-amd64 #1 SMP Debian 4.4.6-1 (2016-03-17) x86_64
> GNU/Linux
> y at d:~$ nethack
> *** buffer overflow detected ***: /usr/lib/games/nethack/nethack-
> console
> terminated
> ======= Backtrace: =========
> /lib/x86_64-linux-gnu/libc.so.6(+0x71ff5)[0x7f22847c6ff5]
> /lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7f228484e347]
> /lib/x86_64-linux-gnu/libc.so.6(+0xf7510)[0x7f228484c510]
> /usr/lib/games/nethack/nethack-console[0x470e16]

This address corresponds to the call to strcpy in src/files.c line
2110. It appears copying the input config line has has overflowed the
'buf' variable located on the stack.

I can reproduce this bug adding a line greater than 256 chars in
~/.nethackrc. You should be able to workaround it by removing any such
lines from nethack config files (~/.nethackrc and the files in
/etc/nethack).

James
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <http://lists.alioth.debian.org/pipermail/pkg-games-devel/attachments/20160326/ab89e7d0/attachment.sig>