[sane-devel] Canon ImageClass MF644Cdw

[David McMahon]

On Thu, Oct 31, 2019 at 2:56 PM Ralph Little <skelband at gmail.com> wrote:

> Hi David,
>
> On Thu, Oct 31, 2019 at 2:45 PM David McMahon <thedjm at gmail.com> wrote:
>
>> ...
>> [bjnp]  00000050:45 53 3a 43 61 6e 6f 6e  20 4d 46 36 34 32 43 2f
>> [bjnp]  00000060:36 34 33 43 2f 36 34 34  43 3b
>> [bjnp] get_scanner_id: Scanner identity string =
>> MFG:CANON;CMD:MFNP1,MultiPASS 2.1;MDL:MF642C/643C/644C;CLS:IMG;DES:Canon
>> MF642C/643C/644C; - length = 90
>> [bjnp] get_scanner_id: Scanner model = MF642C/643C/644C
>> *** buffer overflow detected ***: scanimage terminated
>> Aborted
>>
>>
> Having a quick look at the code, it looks like the very next thing the
> backend does is try to generate a "serial number" by using the hostname.
> Involves an unprotected strcpy().
> Does your scanner machine have a particularly long hostname?
>

Thanks for the clue!  Looking on that on the settings page of the printer,
the hostname is the default of "Canoncbcab3" which seems harmless enough.
I changed it to "Can" to see if that changed anything, but still getting
the buffer overflow.
If you have a link handy to that part of the code, can you point me to it?
Maybe it's something else right after the strcpy().


>
> Cheers,
> Ralph
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/sane-devel/attachments/20191031/7f7b6548/attachment.html>