After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 375295 - the 'randomizer' plugin is broken for at least 2.2.7 and above using some LANGs
the 'randomizer' plugin is broken for at least 2.2.7 and above using some LANGs
Status: RESOLVED FIXED
Product: GIMP
Classification: Other
Component: Plugins
2.2.x
Other Linux
: Normal normal
: 2.2
Assigned To: GIMP Bugs
GIMP Bugs
Depends on:
Blocks:
 
 
Reported: 2006-11-14 21:35 UTC by Andrew Zabolotny
Modified: 2008-01-15 13:14 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Andrew Zabolotny 2006-11-14 21:35:35 UTC
GIMP version at least 2.2.7 (haven't found earlier versions to try) and above (including latest 2.2.13) has a bug that makes it crash when the LANG environment variable is set to some languages that use "long" strings (I think). The Russian language I use (LANG=ru_RU) uses 2 bytes per character in UTF-8; it looks like the randomizer plugin uses somewhere a static buffer for NLS strings which gets overwritten if the strings are too long.

To reproduce, run:

[zap@zap]LANG=ru_RU gimp

After that choose File->New (Файл->Новый), create a default canvas, then choose Filters->Noise->Hurl / Pick (Фильтры->Шум->Бросок / Выбор), then press OK. A message box telling that the plugin has died unexpectedly will pop up. In the console you will see the following message:

*** buffer overflow detected ***: /usr/lib/gimp/2.0/plug-ins/randomize terminated
======= Backtrace: =========
/lib/libc.so.6(__chk_fail+0x41)[0x6232b1]
/lib/libc.so.6(__vsprintf_chk+0x0)[0x622b48]
/lib/libc.so.6(_IO_default_xsputn+0x9c)[0x5a7817]
/lib/libc.so.6(_IO_vfprintf+0xfae)[0x581fc7]
/lib/libc.so.6(__vsprintf_chk+0xa1)[0x622be9]
/lib/libc.so.6(__sprintf_chk+0x30)[0x622b3c]
/usr/lib/gimp/2.0/plug-ins/randomize[0x8049a38]

This should work with glibc 2.4 and above which have a built-in memory trashing detector. With earlier glibc's the bug could not manifest instantly but neverless trashing memory is not a good thing in any case.
Comment 1 Sven Neumann 2006-11-14 22:16:40 UTC
This is already fixed in the HEAD branch for quite a while. I have now also fixed it in 2.2. Thanks for reporting it.

2006-11-14  Sven Neumann  <sven@gimp.org>

	* plug-ins/common/randomize.c: fixed possible buffer overflow
	(bug #375295).