#1150624 fim: FTBFS with buffer overflow in slurp_binary_fd() under _FORTIFY_SOURCE=3

Package:
fim
Source:
fim
Description:
scriptable frame buffer, X.org and ascii art image viewer
Submitter:
Viktor Pashaiev
Date:
2026-10-12 07:39:03 UTC
Severity:
normal
Tags:
#1150624#5
Date:
2026-10-11 13:51:38 UTC
From:
To:
Dear Maintainer,

fim 0.7.1-5 fails to build from source under -D_FORTIFY_SOURCE=3 (e.g. in Ubuntu 26.10).
The test suite aborts during 'make check' when running --script-from-stdin tests:
  *** buffer overflow detected ***: terminated

In src/common.cpp:slurp_binary_fd(), fim_realloc() reallocates the buffer to
(rb+=nrb)+1 bytes. On the next iteration, read() attempts to read inc (4096)
bytes into a buffer that has only 1 remaining byte, causing glibc's __read_chk
to abort.

This is fixed in upstream fim 0.8.0 by allocating (rb+=nrb)+inc+1 bytes and
ensuring NUL termination.

Ubuntu tracking bug: https://bugs.launchpad.net/ubuntu/+source/fim/+bug/2170358
The attached patch backports the upstream fix to 0.7.1-5.

Regards,
Viktor Pashaiev
#1150624#10
Date:
2026-10-12 07:37:10 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
fim, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150624@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Rafael Laboissière <rafael@debian.org> (supplier of updated fim package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 12 Oct 2026 06:33:24 +0000
Source: fim
Architecture: source
Version: 0.8.0-1
Distribution: unstable
Urgency: medium
Maintainer: Michele Martone <michelemartone@users.sourceforge.net>
Changed-By: Rafael Laboissière <rafael@debian.org>
Closes: 1150624
Changes:
 fim (0.8.0-1) unstable; urgency=medium
 .
   * New upstream version 0.8.0
     Closes: #1150624. Thanks to Viktor Pashaiev <w.paszajew@gmail.com> for
     reporting the issue.
   * d/control:
     + Drop the redundant Priority field, which defaults to optional now
     + Bump Standards-Version to 4.7.4 (no changes needed)
     + Bump debhelper compatibility level to 14
     + Drop useless substitution variables ${*:Depends}
     + Build-depend on dh-sequence-single-binary
   * Stop checking upstream tarball signature
     + d/watch: Drop Pgpsigurlmangle field
     + d/u/signing-key.asc: Drop file
   * d/p/disable-readline-tests.patch: Refresh for new upstream version
   * d/p/inkscape-export.patch: Refresh for new upstream version
   * d/p/avoid-unaligned-integer-access.patch: Drop patch (applied upstream)
   * d/copyright:
     + Use hyperlink instead of old FSF physical address
     + Reflect upstream changes
Checksums-Sha1:
 32025fe323854a4b3969d1f948f37a4a2c97afd8 2285 fim_0.8.0-1.dsc
 d237c34cf565e3c9a3bcded2f62b82abb56bd447 853370 fim_0.8.0.orig.tar.bz2
 775a37c82026ac5f9bb256fb62ccb9d874ba3151 9788 fim_0.8.0-1.debian.tar.xz
Checksums-Sha256:
 710f41b4d93bfb9f9ce0c767c737e14376a8102c52deef7fec6ff66b9928c36d 2285 fim_0.8.0-1.dsc
 234d95406f76c28532a939c28d9308f8331a429b5adf735270f2fe2b45d06f0c 853370 fim_0.8.0.orig.tar.bz2
 56025596e331b9584a027895e4529647ecf472498376cc585a15a4a0450ba09a 9788 fim_0.8.0-1.debian.tar.xz
Files:
 087bf1f64ddc26a69b29c38f1653780b 2285 graphics optional fim_0.8.0-1.dsc
 02e9c619ddc0fd25ba453dff4f1ea55f 853370 graphics optional fim_0.8.0.orig.tar.bz2
 2ea7605ec80ce284241cd7ab3ed91e52 9788 graphics optional fim_0.8.0-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEP0ZDkUmP6HS9tdmPISSqGYN4XJAFAmrMiEMSHHJhZmFlbEBk
ZWJpYW4ub3JnAAoJECEkqhmDeFyQm0wP/0adrrAIf3KyVupOhaoLR18HGQs7c+Vi
hUfVbMKVugyfhegdIBNqm9YTFODebsDhkwaf2RqfChj5h8jKuasQJRgAuDoMYRoG
U1DZIyphF+/E2fpM9g5rmmy+u/4cPhNk4aPEg6NEFcS1ap3EEP516xwf5Vh58SjI
6eP3gXoqupeq7FsgX6q5uKU8SH/TsOY/IDyAHlgwDog/2u1NSOOokfsYdlyET6/f
MM79hZq6ZszsZK+nXAom5t3ZX8ImjfL7jXdbS39g812rWktAduZcywQPj4Ocbsu3
X+iWRfRjANaVIshuFXnK4NeOQgIWGwY75bBndz0usYIeguDUmj7SQoeqRPFMLtnh
k0paAh0nnK57J7/AaPD41QVecyEYFvvmqHjXEVw373gaY3wmiJDksQoyXTg27Z2B
A5s8mPw0KCtAl2tii61i66Tz46KQtxnSVFu6wLq5s9XWUe6pC7GatdVy0eGK2F9y
zaZ0/tqwIH8nDbHmJI7EW+e/AfOiwWVaXPrbPU0SJJDhK8FB6BT+24DiZKUfjsvo
5iE2aBruNwmxfwxsFKl/LtDFg4dLk8VB8W1QA3Nu9oMGSsvnVqFt1HLK0rxeNYrJ
BCoqOvKVbL055Pjh4Jl8BiydkZBXBa9qEgpLO2AsBiZU4giRqkWVDFdr6BistIfG
aHiUFPzNfV3s
=8PHz
-----END PGP SIGNATURE-----