Bug#731151: librxtx-java: Buffer overflow detected with large path

[Jose Luis Guardiola]

Package: librxtx-java
Version: 2.2pre2-10
Severity: important

Dear Maintainer,

I've noticed that large system paths produce a buffer overflow (other than reported in #673778). This error 
is produced if you use serial devices out of /dev/tty* (ie. /dev/serial/by-path/pci-0000:00:1d.0-usb-0:1.2:1.0).

I've detected the overflow in message buffer and lock file buffer. So, I've avaluated the solution used in #673778 
but this patch truncates messages (not very important) but lock files (critical). So, finally, I've replaced 
sprintf and snprintf funtions involving file[] and message[] by asprintf and free.

This patch was tested in Linux platform but not others.

Please, check this solution to fix overflows.


-- System Information:
Debian Release: wheezy/sid
  APT prefers precise-updates
  APT policy: (500, 'precise-updates'), (500, 'precise-security'), (500, 'precise'), (100, 'precise-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 3.5.0-41-generic (SMP w/4 CPU cores)
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to C.UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages librxtx-java depends on:
ii  libc6  2.15-0ubuntu10.5

librxtx-java recommends no packages.

librxtx-java suggests no packages.

-- no debconf information
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fix_snprintf.patch
Type: text/x-diff
Size: 10694 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/attachments/20131202/91781853/attachment.patch>