[pouet-Chess] the application starts but the real chess game cannot be started

Bug #493284 reported by Miroslav Hadzhiev
40
This bug affects 7 people
Affects Status Importance Assigned to Milestone
pouetchess (Debian)
Fix Released
Unknown
pouetchess (Ubuntu)
Fix Released
Medium
Unassigned

Bug Description

Binary package hint: pouetchess

The game starts but when you select "One Player" or "Two Players" to start the chess game, the application just closes (and even without reverting the resolution from 1024x768 to my standard 1680x1050).

ProblemType: Bug
Architecture: amd64
Date: Sun Dec 6 22:09:34 2009
DistroRelease: Ubuntu 9.10
InstallationMedia: Ubuntu 9.10 "Karmic Koala" - Release amd64 (20091027)
Package: pouetchess 0.2.0-4
ProcEnviron:
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-16.52-generic
SourcePackage: pouetchess
Uname: Linux 2.6.31-16-generic x86_64

Revision history for this message
Miroslav Hadzhiev (xtigyro) wrote :
summary: - [pouet-Chess] the game cannnot be started at all
+ [pouet-Chess] the application starts but the real chess game cannot be
+ started
Revision history for this message
ycswyw (ycswyw) wrote :
Download full text (6.8 KiB)

I'm running "pouetChess" from command line, and I get these errors when I select "One player" option:

*** buffer overflow detected ***: pouetChess terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x37)[0x7f4de7db6647]
/lib/libc.so.6[0x7f4de7db55f0]
/lib/libc.so.6[0x7f4de7db4a59]
/lib/libc.so.6(_IO_default_xsputn+0x98)[0x7f4de7d33448]
/lib/libc.so.6(_IO_vfprintf+0x5a5)[0x7f4de7d04345]
/lib/libc.so.6(__vsprintf_chk+0x99)[0x7f4de7db4af9]
/lib/libc.so.6(__sprintf_chk+0x7f)[0x7f4de7db4a3f]
pouetChess[0x40adba]
pouetChess[0x408a08]
pouetChess[0x408b71]
pouetChess[0x4062cb]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7f4de7cddabd]
pouetChess[0x4056b9]
======= Memory map: ========
00400000-00455000 r-xp 00000000 08:05 1033211 /usr/games/pouetChess
00654000-00655000 r--p 00054000 08:05 1033211 /usr/games/pouetChess
00655000-00657000 rw-p 00055000 08:05 1033211 /usr/games/pouetChess
00657000-00e3b000 rw-p 00000000 00:00 0
01aec000-0202a000 rw-p 00000000 00:00 0 [heap]
4067b000-406f9000 rw-p 00000000 00:0f 1533 /dev/zero
41d38000-41d3a000 rwxp 00000000 00:0f 1533 /dev/zero
7f4de1f44000-7f4de2144000 rw-s 2e4db000 00:0f 5786 /dev/nvidia0
7f4de2347000-7f4de3748000 rw-p 00000000 00:00 0
7f4de3748000-7f4de3788000 rw-s dff7e000 00:0f 5786 /dev/nvidia0
7f4de3788000-7f4de3888000 rw-s 37836000 00:0f 5786 /dev/nvidia0
7f4de3888000-7f4de3889000 rw-s e0c04000 00:0f 5786 /dev/nvidia0
7f4de3889000-7f4de3989000 rw-s 38dca000 00:0f 5786 /dev/nvidia0
7f4de3989000-7f4de3e89000 rw-s d0000000 00:0f 5786 /dev/nvidia0
7f4de3e89000-7f4de3e8e000 r-xp 00000000 08:05 1031242 /usr/lib/libXfixes.so.3.1.0
7f4de3e8e000-7f4de408d000 ---p 00005000 08:05 1031242 /usr/lib/libXfixes.so.3.1.0
7f4de408d000-7f4de408e000 r--p 00004000 08:05 1031242 /usr/lib/libXfixes.so.3.1.0
7f4de408e000-7f4de408f000 rw-p 00005000 08:05 1031242 /usr/lib/libXfixes.so.3.1.0
7f4de408f000-7f4de4098000 r-xp 00000000 08:05 1030820 /usr/lib/libXrender.so.1.3.0
7f4de4098000-7f4de4297000 ---p 00009000 08:05 1030820 /usr/lib/libXrender.so.1.3.0
7f4de4297000-7f4de4298000 r--p 00008000 08:05 1030820 /usr/lib/libXrender.so.1.3.0
7f4de4298000-7f4de4299000 rw-p 00009000 08:05 1030820 /usr/lib/libXrender.so.1.3.0
7f4de4299000-7f4de42a2000 r-xp 00000000 08:05 1031248 /usr/lib/libXcursor.so.1.0.2
7f4de42a2000-7f4de44a1000 ---p 00009000 08:05 1031248 /usr/lib/libXcursor.so.1...

Read more...

Revision history for this message
Niall Creech (sevenmachines-deactivatedaccount) wrote :

buffer overflow in C3DGraphicChessboard::load() call to sprintf

- char texture_filename[50];
- sprintf(texture_filename,PC_DATA_TEXTURE_SKYBOX,i),
+ char texture_filename[1024];
+ snprintf(texture_filename,1023,PC_DATA_TEXTURE_SKYBOX,i),

Revision history for this message
Niall Creech (sevenmachines-deactivatedaccount) wrote :

hold on, fixed differently in svn

Revision history for this message
Niall Creech (sevenmachines-deactivatedaccount) wrote :

From svn, no obvious commit. will mention to debian

Changed in pouetchess (Ubuntu):
status: New → In Progress
assignee: nobody → SevenMachines (sevenmachines)
Revision history for this message
Niall Creech (sevenmachines-deactivatedaccount) wrote :

Forwarded to debian with
-#import
+#include
i'll see what they say, package is quite old

Changed in pouetchess (Ubuntu):
assignee: SevenMachines (sevenmachines) → nobody
Revision history for this message
Niall Creech (sevenmachines-deactivatedaccount) wrote :
tags: added: patch
tags: added: patch-forwarded-debian
Revision history for this message
Niall Creech (sevenmachines-deactivatedaccount) wrote :

Debdiff attached

Test build: https://edge.launchpad.net/~sevenmachines/+archive/release+1

pouetchess (0.2.0-4ubuntu1) maverick; urgency=low

  * 20_sprintf-buff-overflow-fix.patch:
    - Fix buffer overflow in C3DGraphicChessboard::load() call to sprintf (LP: #493284)

Changed in pouetchess (Ubuntu):
status: In Progress → Confirmed
Changed in pouetchess (Ubuntu):
importance: Undecided → Medium
Revision history for this message
Stefano Rivera (stefanor) wrote :

W: pouetchess-data: debian-changelog-line-too-long line 2

Corrected on upload. (it also had trailing whitespace on that line)

Changed in pouetchess (Ubuntu):
status: Confirmed → Fix Committed
Revision history for this message
Niall Creech (sevenmachines-deactivatedaccount) wrote :

Thanks stefano

Revision history for this message
Stefano Rivera (stefanor) wrote :

Auto-closing bugs is still down...

pouetchess (0.2.0-4ubuntu1) maverick; urgency=low

  * 20_sprintf-buff-overflow-fix.patch:
    - Fix buffer overflow in C3DGraphicChessboard::load() call to sprintf
      (LP: #493284)

Changed in pouetchess (Ubuntu):
status: Fix Committed → Fix Released
Changed in pouetchess (Debian):
status: Unknown → New
Changed in pouetchess (Debian):
status: New → Fix Released
Revision history for this message
jbatista (jmnbatista) wrote :
Download full text (14.2 KiB)

Bug on Lucid (amd64).
pouetChess assert failure: *** buffer overflow detected ***: pouetChess terminated
Console output:

*** buffer overflow detected ***: pouetChess terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x37)[0x7ff588dc57e7]
/lib/libc.so.6(+0xfe6a0)[0x7ff588dc46a0]
/lib/libc.so.6(+0xfdb09)[0x7ff588dc3b09]
/lib/libc.so.6(_IO_default_xsputn+0xcc)[0x7ff588d3bf6c]
/lib/libc.so.6(_IO_vfprintf+0x670)[0x7ff588d0ba10]
/lib/libc.so.6(__vsprintf_chk+0x99)[0x7ff588dc3ba9]
/lib/libc.so.6(__sprintf_chk+0x7f)[0x7ff588dc3aef]
pouetChess[0x40adba]
pouetChess[0x408a08]
pouetChess[0x408b71]
pouetChess[0x4062cb]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7ff588ce4c4d]
pouetChess[0x4056b9]
======= Memory map: ========
00400000-00455000 r-xp 00000000 08:02 12335847 /usr/games/pouetChess
00654000-00655000 r--p 00054000 08:02 12335847 /usr/games/pouetChess
00655000-00657000 rw-p 00055000 08:02 12335847 /usr/games/pouetChess
00657000-00e3b000 rw-p 00000000 00:00 0
0131c000-01879000 rw-p 00000000 00:00 0 [heap]
404c9000-40528000 rw-p 00000000 00:05 1346 /dev/zero
412fb000-412fd000 rwxp 00000000 00:05 1346 /dev/zero
7ff580307000-7ff580507000 rw-s 4e3b5d000 00:05 8252 /dev/nvidia0
7ff580c09000-7ff580c2e000 r-xp 00000000 08:02 35395321 /lib/libpng12.so.0.42.0
7ff580c2e000-7ff580e2e000 ---p 00025000 08:02 35395321 /lib/libpng12.so.0.42.0
7ff580e2e000-7ff580e2f000 r--p 00025000 08:02 35395321 /lib/libpng12.so.0.42.0
7ff580e2f000-7ff580e30000 rw-p 00026000 08:02 35395321 /lib/libpng12.so.0.42.0
7ff580e8c000-7ff58228d000 rw-p 00000000 00:00 0
7ff58228d000-7ff58248d000 rw-s 4f18b2000 00:05 8252 /dev/nvidia0
7ff58248d000-7ff58258d000 rw-s 56d6aa000 00:05 8252 /dev/nvidia0
7ff58258d000-7ff5825cd000 rw-s 5b6871000 00:05 8252 /dev/nvidia0
7ff5825cd000-7ff5825d2000 r-xp 00000000 08:02 12323637 /usr/lib/libXfixes.so.3.1.0
7ff5825d2000-7ff5827d1000 ---p 00005000 08:02 12323637 /usr/lib/libXfixes.so.3.1.0
7ff5827d1000-7ff5827d2000 r--p 00004000 08:02 12323637 /usr/lib/libXfixes.so.3.1.0
7ff5827d2000-7ff5827d3000 rw-p 00005000 08:02 12323637 /usr/lib/libXfixes.so.3.1.0
7ff5827d3000-7ff5827dc000 r-xp 00000000 08:02 12323657 /usr/lib/libXrender.so.1.3.0
7ff5827dc000-7ff5829db000 ---p 00009000 08:02 12323657 /usr/lib/libXrender.so.1.3.0
7ff5829db000-7ff5829dc000 r--p 00008000 08:02 12323657 /usr/lib/libXrender.so.1.3.0
7ff5829dc000-7ff5829dd000 rw-p 00009000 08:02 12323657 /usr/lib/libXrender.so.1.3.0
7ff5829dd000-7ff5829e6000 r-xp 00000000 08:02 12323629 /usr/lib/libXcursor.so.1.0.2
7ff5829e6000-7ff582be5000 ---p 00009000 08:02 12323629 /usr/lib/libXcursor.so.1.0.2
7ff582be5000-7ff582be6000 r--p 00008000 08:02 12323629 /usr/lib/libXcurs...

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.