BUG : fix security bug reported via debian by Matt Giuca

mgiuca-google · tacaswell · commit 32d7a9f7184a · 2015-02-08T20:59:34.000-05:00
Fixes CVE-2013-1424
diff --git a/lib/matplotlib/__init__.py b/lib/matplotlib/__init__.py
@@ -1402,6 +1402,7 @@ def tk_window_focus():
     'matplotlib.tests.test_lines',
     'matplotlib.tests.test_mathtext',
     'matplotlib.tests.test_mlab',
+    'matplotlib.tests.test_mplutils',
     'matplotlib.tests.test_patches',
     'matplotlib.tests.test_path',
     'matplotlib.tests.test_patheffects',
diff --git a/lib/matplotlib/tests/test_mplutils.py b/lib/matplotlib/tests/test_mplutils.py
@@ -0,0 +1,12 @@
+from __future__ import print_function
+from nose.tools import assert_raises
+from matplotlib import ft2font
+from matplotlib.testing.decorators import knownfailureif
+import sys
+
+def test_printf_buffer():
+    """Tests Printf for buffer overrun."""
+    # Use ft2font.FT2Font, which indirectly calls the Printf function in
+    # mplutils.cpp.
+    # Expect a RuntimeError, since the font is not found.
+    assert_raises(RuntimeError, ft2font.FT2Font, 'x' * 2048)
diff --git a/src/mplutils.cpp b/src/mplutils.cpp
@@ -18,7 +18,10 @@ Printf::Printf(const char *fmt, ...)
 {
     va_list ap;
     va_start(ap, fmt);
-    vsprintf(buffer, fmt, ap);
+    vsnprintf(buffer, 1024, fmt, ap);
+    // Null-terminate the string. Non-standard C implementations (e.g.,
+    // Microsoft Visual C++) do not do this automatically.
+    buffer[1023] = '\0';
     va_end(ap);  // look ma - I rememberd it this time
 }
 

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,10 @@ Printf::Printf(const char *fmt, ...)`
`18`	`18`	`{`
`19`	`19`	`va_list ap;`
`20`	`20`	`va_start(ap, fmt);`
`21`		`- vsprintf(buffer, fmt, ap);`
	`21`	`+ vsnprintf(buffer, 1024, fmt, ap);`
	`22`	`+ // Null-terminate the string. Non-standard C implementations (e.g.,`
	`23`	`+ // Microsoft Visual C++) do not do this automatically.`
	`24`	`+ buffer[1023] = '\0';`
`22`	`25`	`va_end(ap); // look ma - I rememberd it this time`
`23`	`26`	`}`
`24`	`27`