Buffer overrun about figlet HOT 8 OPEN

The problem is not initializing or reinitializing outputline[] buffer content to NUL, causing STRCAT to read more characters than it should because it doesn't find the normal NUL character when STRCAT doesn't start reading from the beginning of the buffer.
There are also cases of corruption, with extra appended characters from uninitialized memory.
Both problems fixed in clearline() (i.e. when the buffers are recycled) and myalloc() (first allocation).

from figlet.

Another case of buffer overrun in the same function, again for right to left layout: smushing away more characters that are contained in the outputline[] buffers, with STRCAT being passed an invalid pointer (past the end of an outputline[] buffer).

How is it possible to smush more characters than the length of the buffer? A single character can be wider than the current line, but smushamt() doesn't limit the amount of smushing to the length of the current line. Enormous amounts of smushing are possible with space-rich fonts, such as the Obanner collection.

Fixed in smushamt() by limiting the range of the result.

Test case:

$ figlet -f obanner132.flf -R -x -o -p -w 77 "Banner, o Banner"

from figlet.

Thanks, I'll check that and report back.

from figlet.

I created a pull request (#5) addressing both problems.

from figlet.

Hi @cmatsuoka,

Any update on this?

Cheers,
Jon

from figlet.

Oops, I think I forgot to provide a follow-up. Sorry, Lorenzo and Jon. Let me check exactly what happened and I'll post an update ASAP.

from figlet.

I'm checking the current code with valgrind and it seems that we have more memory issues. I didn't apply Lorenzo's code directly because it caused some of the regression tests to fail, so I'll investigate this further and rework the patch to cover all cases.

from figlet.

I changed Lorenzo's smush fix to be used only in the right-to-left case to prevent side effects in left-to-right smushing, and added a new regression test for the right-to-left memory corruption problem. I'm pushing this to master, please check if it works for you.

from figlet.