[Debian-med-packaging] Bug#1150954: pftools: Fix heap buffer overflow in PrintTSV

[Sebastien Bacher]

Source: pftools
Version: 3.2.12-3ubuntu1
Severity: normal
Tags: patch
X-Debbugs-Cc: seb128 at ubuntu.com
User: ubuntu-devel at lists.ubuntu.com
Usertags: origin-ubuntu stonking ubuntu-patch

Hi,

pfsearchV3 has a one-byte heap overflow in PrintTSV() (src/C/utils/output.c):

  char * ac  = calloc(strlen(prf->AC_Number),sizeof(char));
  strcpy(ac,prf->AC_Number);

The buffer has no room for the ending NUL (the other output functions
in the same file use 1+strlen()). It's visible with -D_FORTIFY_SOURCE=3,
which Ubuntu uses by default: the TSV output test aborts with
"*** buffer overflow detected ***" and the build fails.

The attached patch fixes it; with it all 6 tests pass. It's still present
in upstream master (v3.2.13).

Ubuntu bug: https://bugs.launchpad.net/bugs/2170856

Thanks,
Sebastien Bacher


-- System Information:
Debian Release: forky/sid
  APT prefers resolute-updates
  APT policy: (500, 'resolute-updates'), (500, 'resolute-security'), (500, 'resolute'), (100, 'resolute-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.0-38-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
-------------- next part --------------
Description: Fix heap buffer overflow in PrintTSV
 The buffer for the accession number is allocated without room for the
 ending NUL, so the following strcpy() writes one byte past the end.
 With _FORTIFY_SOURCE=3 this aborts pfsearchV3 -o 7 (TSV output).
 The other output functions already allocate 1+strlen().
Author: Sebastien Bacher <seb128 at ubuntu.com>
Bug-Ubuntu: https://bugs.launchpad.net/bugs/2170856
Forwarded: https://github.com/sib-swiss/pftools3/pull/33
Last-Update: 2026-10-15
Index: pftools-3.2.12/src/C/utils/output.c
===================================================================
--- pftools-3.2.12.orig/src/C/utils/output.c
+++ pftools-3.2.12/src/C/utils/output.c
@@ -64,7 +64,7 @@ void PrintTSV(const struct Profile * con
     while ( *cptr != ';' && *cptr != '\0') ++cptr;
     *cptr = '\0';
 
-    char * ac  = calloc(strlen(prf->AC_Number),sizeof(char));
+    char * ac  = calloc(1+strlen(prf->AC_Number),sizeof(char));
     strcpy(ac,prf->AC_Number);
     cptr = ac;
     while ( *cptr != ';' && *cptr != '\0' ) ++cptr;