-
-
Notifications
You must be signed in to change notification settings - Fork 351
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Bug] lib/arraystats: heap buffer overflow in disabled 'Discont' algorithm #5486
Comments
nilason
added a commit
to nilason/grass
that referenced
this issue
Apr 11, 2025
Addresses heap buffer overflow in previously disabled 'Discont' algorithm. The immediate cause was too small allocation of variable `num` in `AS_class_discont()`, which was fixed by an increase it's size (broadly mirroring the original Fortran code). This fix was complemented by some code related improvements: - Code clean up and restructure of `AS_class_discont()` - Re-enable "dis" algorithm in v.class and d.vect.thematic - Pass `classbreaks` array by pointer to pointer to enable in- and output. See: https://lists.osgeo.org/pipermail/grass-dev/2008-July/038951.html Fixes: OSGeo#5486
nilason
added a commit
to nilason/grass
that referenced
this issue
Apr 11, 2025
Addresses heap buffer overflow in previously disabled 'Discont' algorithm. The immediate cause was too small allocation of variable `num` in `AS_class_discont()`, which was fixed by an increase of it's size (broadly mirroring the original Fortran code). This fix was complemented by some code related improvements: - Code clean up and restructure of `AS_class_discont()` - Re-enable "dis" algorithm in v.class and d.vect.thematic - Pass `classbreaks` array by pointer to pointer to enable in- and output. See: https://lists.osgeo.org/pipermail/grass-dev/2008-July/038951.html Fixes: OSGeo#5486
nilason
added a commit
to nilason/grass
that referenced
this issue
Apr 12, 2025
Addresses heap buffer overflow in previously disabled 'Discont' algorithm. The immediate cause was too small allocation of variable `num` in `AS_class_discont()`, which was fixed by an increase of it's size (broadly mirroring the original Fortran code). This fix was complemented by some code related improvements: - Code clean up and restructure of `AS_class_discont()` - Re-enable "dis" algorithm in v.class and d.vect.thematic - Pass `classbreaks` array by pointer to pointer to enable in- and output. See: https://lists.osgeo.org/pipermail/grass-dev/2008-July/038951.html Fixes: OSGeo#5486
nilason
added a commit
to nilason/grass
that referenced
this issue
Apr 13, 2025
Addresses heap buffer overflow in previously disabled 'Discont' algorithm. The immediate cause was too small allocation of variable `num` in `AS_class_discont()`, which was fixed by an increase of its size (broadly mirroring the original Fortran code). This fix was complemented by some code related improvements: - Code clean up and restructure of `AS_class_discont()` - Re-enable "dis" algorithm in v.class and d.vect.thematic - Pass `classbreaks` array by pointer to pointer to enable in- and output. See: https://lists.osgeo.org/pipermail/grass-dev/2008-July/038951.html Fixes: OSGeo#5486
nilason
added a commit
to nilason/grass
that referenced
this issue
Apr 13, 2025
Addresses heap buffer overflow in previously disabled 'Discont' algorithm. The immediate cause was too small allocation of variable `num` in `AS_class_discont()`, which was fixed by an increase of its size (broadly mirroring the original Fortran code). This fix was complemented by some code related improvements: - Code clean up and restructure of `AS_class_discont()` - Re-enable "dis" algorithm in v.class and d.vect.thematic - Pass `classbreaks` array by pointer to pointer to enable in- and output. See: https://lists.osgeo.org/pipermail/grass-dev/2008-July/038951.html Fixes: OSGeo#5486
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Shortly after introduction of GRASS arraystats library, a bug was discovered for the "Discont" algorithm, see ML, which was then disabled ac3098c.
Debugging this revealed a heap buffer overflow in line:
grass/lib/arraystats/class.c
Line 412 in bbb23c9
The value of the variables at the AddressSanitizer breakpoint after running the equivalent to
v.class map=boundary_municp column=POP_APR_20 algo=dis nbclasses=5
was:Note the size of
num
is5 + 1
:grass/lib/arraystats/class.c
Line 299 in bbb23c9
which obviously fails setting
num[6]
(num[5] is max).I'm not familiar with the algorithm to present a fix for this.
@mlennert Perhaps you can revisit this now?
The text was updated successfully, but these errors were encountered: