<?xml version="1.0" encoding="UTF-8" ?>

<bugzilla version="5.2"
          urlbase="https://bugzilla.altlinux.org/"
          
          maintainer="jenya@basealt.ru"
>

    <bug>
          <bug_id>32957</bug_id>
          
          <creation_ts>2016-12-30 14:39:28 +0300</creation_ts>
          <short_desc>__builtin___memcpy_chk always overflow destination buffer</short_desc>
          <delta_ts>2016-12-30 15:02:12 +0300</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>4</classification_id>
          <classification>Development</classification>
          <product>Sisyphus</product>
          <component>glibc-devel</component>
          <version>unstable</version>
          <rep_platform>all</rep_platform>
          <op_sys>Linux</op_sys>
          <bug_status>CLOSED</bug_status>
          <resolution>NOTABUG</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P3</priority>
          <bug_severity>normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Sergey V Turchin">zerg</reporter>
          <assigned_to name="Gleb F-Malinovskiy">glebfm</assigned_to>
          <cc>glebfm</cc>
    
    <cc>ldv</cc>
          
          <qa_contact>qa-sisyphus</qa_contact>

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>161147</commentid>
    <comment_count>0</comment_count>
    <who name="Sergey V Turchin">zerg</who>
    <bug_when>2016-12-30 14:39:28 +0300</bug_when>
    <thetext>glibc-devel-2.24-alt1
gcc5-c++-5.3.1-alt3

/usr/include/bits/string3.h:55:71: error: call to void* __builtin___memcpy_chk(void*, const void*, long unsigned int, long unsigned int) will always overflow destination buffer


In file included from /usr/include/string.h:648:0,
                 from /usr/include/qt5/QtCore/qarraydata.h:44,
                 from /usr/include/qt5/QtCore/qlist.h:46,
                 from /usr/include/qt5/QtCore/qqueue.h:43,
                 from /usr/include/qt5/QtCore/QQueue:1,
                 from qlowenergycontroller_p.h:73,
                 from qlowenergycontroller_bluez.cpp:42:
In function &apos;void* memcpy(void*, const void*, size_t)&apos;,
    inlined from &apos;void qToUnaligned(T, void*) [with T = short unsigned int]&apos; at /usr/include/qt5/QtCore/qendian.h:82:5,
    inlined from &apos;void qToLittleEndian(T, void*) [with T = short unsigned int]&apos; at /usr/include/qt5/QtCore/qendian.h:227:3,
    inlined from &apos;void putBtData(T, void*) [with T = short unsigned int]&apos; at bluez/bluez_data_p.h:192:5,
    inlined from &apos;void QLowEnergyControllerPrivate::readServiceValuesByOffset(uint, quint16, bool)&apos; at qlowenergycontroller_bluez.cpp:1510:34:


http://code.qt.io/cgit/qt/qtconnectivity.git/tree/src/bluetooth/qlowenergycontroller_bluez.cpp?h=v5.7.1

P.S.
Не могу собрать Qt-5.7.1 .</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>161149</commentid>
    <comment_count>1</comment_count>
    <who name="Dmitry V. Levin">ldv</who>
    <bug_when>2016-12-30 14:57:27 +0300</bug_when>
    <thetext>Ну так там переполнение буфера, скажи спасибо, что тебе не дают это собрать.

void QLowEnergyControllerPrivate::readServiceValuesByOffset(
        uint handleData, quint16 offset, bool isLastValue)
...
quint8 packet[3];
...
putBtData(offset, &amp;packet[3]);

т.е. ты пишешь quint16 по адресу последнего элемента массива quint8.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>161150</commentid>
    <comment_count>2</comment_count>
    <who name="Sergey V Turchin">zerg</who>
    <bug_when>2016-12-30 15:02:12 +0300</bug_when>
    <thetext>Спасибо! Теперь понятно.</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>