Ubuntu
sane-backends package

Sane lib crashes with "buffer overflow detected"

Bug #572246 reported by David Erosa on 2010-04-30

This bug affects 14 people

Affects		Status	Importance	Assigned to	Milestone
	Simple Scan	Invalid	Undecided	Unassigned
	sane-backends (Ubuntu)	Invalid	Undecided	Unassigned

Bug Description

Binary package hint: simple-scan

derosa@bowman:~$ simple-scan
*** buffer overflow detected ***: simple-scan ======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.i686/cmov/libc.so.i686/cmov/libc.so.sane/libsane-epson2.sane/libsane-epson2.sane/libsane-epson2.sane/libsane-epson2.sane/libsane-epson2.libsane.so.1(sane_libsane.so.1(sane_scan[0x805a774]
/lib/libglib-2.0.so.0(+0x65dcf)i686/cmov/libpthread.i686/cmov/libc.so. 00110000-00159000 r-xp 00000000 08:05 824342 00159000-00161000 r--p 00049000 08:05 824342 00161000-00163000 rw-p 00051000 08:05 824342 00163000-0016a000 r-xp 00000000 08:05 1835047 0016a000-0016b000 r--p 00006000 08:05 1835047 0016b000-0016c000 rw-p 00007000 08:05 1835047 0016c000-00176000 r-xp 00000000 08:05 1835127 00176000-00177000 r--p 00009000 08:05 1835127 00177000-00178000 rw-p 0000a000 08:05 1835127 00178000-00182000 r-xp 00000000 08:05 824631 00182000-00183000 r--p 00009000 08:05 824631 00183000-00184000 rw-p 0000a000 08:05 824631 00184000-00199000 r-xp 00000000 08:05 1835045 00199000-0019a000 r--p 00014000 08:05 1835045 0019a000-0019b000 rw-p 00015000 08:05 1835045 0019b000-0019d000 rw-p 00000000 00:00 0019d000-00230000 r-xp 00000000 08:05 824756 00230000-00232000 r--p 00093000 08:05 824756 00232000-00233000 rw-p 00095000 08:05 824756 00233000-002aa000 r-xp 00000000 08:05 824482 002aa000-002ac000 r--p 00076000 08:05 824482 002ac000-002ad000 rw-p 00078000 08:05 824482 002ad000-002af000 r-xp 00000000 08:05 824663 002af000-002b0000 r--p 00001000 08:05 824663 002b0000-002b1000 rw-p 00002000 08:05 824663 002b1000-002b3000 r-xp 00000000 08:05 824674 002b3000-002b4000 r--p 00001000 08:05 824674 002b4000-002b5000 rw-p 00002000 08:05 824674 002b5000-002b9000 r-xp 00000000 08:05 817026 002b9000-002ba000 r--p 00003000 08:05 817026 002ba000-002bb000 rw-p 00004000 08:05 817026 002bb000-002bd000 r-xp 00000000 08:05 1835034 002bd000-002be000 r--p 00001000 08:05 1835034 002be000-002bf000 rw-p 00002000 08:05 1835034 002bf000-002c4000 r-xp 00000000 08:05 825107 002c4000-002c5000 r--p 00005000 08:05 825107 002c5000-002c6000 rw-p 00006000 08:05 825107 002c6000-002fd000 r-xp 00000000 08:05 1835070 002fd000-002fe000 r--p 00036000 08:05 1835070 002fe000-002ff000 rw-p 00037000 08:05 1835070 002ff000-00318000 r-xp 00000000 08:05 824272 00318000-00319000 ---p 00019000 08:05 824272 00319000-0031a000 r--p 00019000 08:05 824272 0031a000-0031b000 rw-p 0001a000 08:05 824272 0031b000-00340000 r-xp 00000000 08:05 824632 00340000-00341000 r--p 00024000 08:05 824632 00341000-00342000 rw-p 00025000 08:05 824632 00342000-00350000 r-xp 00000000 08:05 816847 00350000-00351000 r--p 0000d000 08:05 816847 00351000-00352000 rw-p 0000e000 08:05 816847 00352000-0035a000 r-xp 00000000 08:05 824480 0035a000-0035b000 r--p 00007000 08:05 824480 0035b000-0035c000 rw-p 00008000 08:05 824480 0035c000-00377000 r-xp 00000000 08:05 1839434 00377000-00378000 r--p 0001a000 08:05 1839434 00378000-00379000 rw-p 0001b000 08:05 1839434 00379000-00746000 r-xp 00000000 08:05 824755 00746000-0074a000 r--p 003cd000 08:05 824755 0074a000-0074c000 rw-p 003d1000 08:05 824755 0074c000-0074e000 rw-p 00000000 00:00 0074e000-00751000 r-xp 00000000 08:05 824474 00751000-00752000 r--p 00002000 08:05 824474 00752000-00753000 rw-p 00003000 08:05 824474 00754000-00794000 r-xp 00000000 08:05 824630 00794000-00795000 ---p 00040000 08:05 824630 00795000-00796000 r--p 00040000 08:05 824630 00796000-00797000 rw-p 00041000 08:05 824630 00797000-007c5000 r-xp 00000000 08:05 818589 007c5000-007c6000 r--p 0002d000 08:05 818589 007c6000-007c7000 rw-p 0002e000 08:05 818589 007c7000-007d3000 r-xp 00000000 08:05 817038 007d3000-007d4000 r--p 0000c000 08:05 817038 007d4000-007d5000 rw-p 0000d000 08:05 817038 007d5000-007db000 r-xp 00000000 08:05 824686 007db000-007dc000 r--p 00005000 08:05 824686 007dc000-007dd000 rw-p 00006000 08:05 824686 007dd000-007e5000 r-xp 00000000 08:05 824449 007e5000-007e6000 r--p 00007000 08:05 824449 007e6000-007e7000 rw-p 00008000 08:05 824449 007e7000-007fb000 r-xp 00000000 08:05 824447 derosa@bowman:~$ terminated
/>6(__fortify_fail+0x50)[0xfc6350]
/>6(+0xe128a)[0xfc528a]
/>6(+0xe05ba)[0xfc45ba]
/>so.1(+0x121ad)[0x45571ad]
/>so.1(+0x1257a)[0x455757a]
/>so.1(sanei_configure_attach+0x495)[0x454a785]
/>so.1(+0x103b7)[0x45553b7]
/>so.1(sane_epson2_get_devices+0x39)[0x4556f59]
/>dll_get_devices+0xb2)[0xca8ea2]
/>get_devices+0x24)[0xca69b4]
/>[0x8a4dcf]
/>so.0(+0x596e)[0x18996e]
/>6(clone+0x5e)[0xfb1a0e]
/usr/lib/libORBit-2.so.0.1.0
/usr/lib/libORBit-2.so.0.1.0
/usr/lib/libORBit-2.so.0.1.0
/lib/tls/i686/cmov/librt-2.11.1.so
/lib/tls/i686/cmov/librt-2.11.1.so
/lib/tls/i686/cmov/librt-2.11.1.so
/lib/libudev.so.0.6.1
/lib/libudev.so.0.6.1
/lib/libudev.so.0.6.1
/usr/lib/libpangocairo-1.0.so.0.2800.0
/usr/lib/libpangocairo-1.0.so.0.2800.0
/usr/lib/libpangocairo-1.0.so.0.2800.0
/lib/tls/i686/cmov/libpthread-2.11.1.so
/lib/tls/i686/cmov/libpthread-2.11.1.so
/lib/tls/i686/cmov/libpthread-2.11.1.so
0
/usr/lib/libgdk-x11-2.0.so.0.2000.0
/usr/lib/libgdk-x11-2.0.so.0.2000.0
/usr/lib/libgdk-x11-2.0.so.0.2000.0
/usr/lib/libcairo.so.2.10800.10
/usr/lib/libcairo.so.2.10800.10
/usr/lib/libcairo.so.2.10800.10
/usr/lib/libXcomposite.so.1.0.0
/usr/lib/libXcomposite.so.1.0.0
/usr/lib/libXcomposite.so.1.0.0
/usr/lib/libXdamage.so.1.1.0
/usr/lib/libXdamage.so.1.1.0
/usr/lib/libXdamage.so.1.1.0
/usr/lib/libXfixes.so.3.1.0
/usr/lib/libXfixes.so.3.1.0
/usr/lib/libXfixes.so.3.1.0
/lib/tls/i686/cmov/libdl-2.11.1.so
/lib/tls/i686/cmov/libdl-2.11.1.so
/lib/tls/i686/cmov/libdl-2.11.1.so
/usr/lib/libgudev-1.0.so.0.0.1
/usr/lib/libgudev-1.0.so.0.0.1
/usr/lib/libgudev-1.0.so.0.0.1
/lib/libdbus-1.so.3.4.0
/lib/libdbus-1.so.3.4.0
/lib/libdbus-1.so.3.4.0
/usr/lib/libatk-1.0.so.0.3009.1
/usr/lib/libatk-1.0.so.0.3009.1
/usr/lib/libatk-1.0.so.0.3009.1
/usr/lib/libatk-1.0.so.0.3009.1
/usr/lib/libpangoft2-1.0.so.0.2800.0
/usr/lib/libpangoft2-1.0.so.0.2800.0
/usr/lib/libpangoft2-1.0.so.0.2800.0
/usr/lib/libXext.so.6.4.0
/usr/lib/libXext.so.6.4.0
/usr/lib/libXext.so.6.4.0
/usr/lib/libXrender.so.1.3.0
/usr/lib/libXrender.so.1.3.0
/usr/lib/libXrender.so.1.3.0
/lib/ld-2.11.1.so
/lib/ld-2.11.1.so
/lib/ld-2.11.1.so
/usr/lib/libgtk-x11-2.0.so.0.2000.0
/usr/lib/libgtk-x11-2.0.so.0.2000.0
/usr/lib/libgtk-x11-2.0.so.0.2000.0
0
/usr/lib/libxcb-render-util.so.0.0.0
/usr/lib/libxcb-render-util.so.0.0.0
/usr/lib/libxcb-render-util.so.0.0.0
/usr/lib/libpango-1.0.so.0.2800.0
/usr/lib/libpango-1.0.so.0.2800.0
/usr/lib/libpango-1.0.so.0.2800.0
/usr/lib/libpango-1.0.so.0.2800.0
/usr/lib/libfontconfig.so.1.4.4
/usr/lib/libfontconfig.so.1.4.4
/usr/lib/libfontconfig.so.1.4.4
/usr/lib/libXi.so.6.1.0
/usr/lib/libXi.so.6.1.0
/usr/lib/libXi.so.6.1.0
/usr/lib/libXrandr.so.2.2.0
/usr/lib/libXrandr.so.2.2.0
/usr/lib/libXrandr.so.2.2.0
/usr/lib/libfusion-1.2.so.0.8.0
/usr/lib/libfusion-1.2.so.0.8.0
/usr/lib/libfusion-1.2.so.0.8.0
/usr/lib/libdirect-1.2.so.0.8.0Cancelado

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: simple-scan 1.0.2-0ubuntu1
ProcVersionSignature: Ubuntu 2.6.32-21.32-generic 2.6.32.11+drm33.2
Uname: Linux 2.6.32-21-generic i686
Architecture: i386
Date: Fri Apr 30 13:36:36 2010
DriverPackageVersions:
libsane 1.0.20-13ubuntu2
libsane-extras N/A
hplip 3.10.2-2ubuntu2
hpoj N/A
MachineType: Acer Veriton M670G/M670
ProcCmdLine: BOOT_IMAGE=/vmlinuz-2.6.32-21-generic root=UUID=40237d0b-a9a4-43b2-a01c-f8a8511c9192 ro quiet splash
ProcEnviron:
PATH=(custom, user)
LANG=es_ES.utf8
SHELL=/bin/bash
SourcePackage: simple-scan
dmi.bios.date: 11/20/2008
dmi.bios.vendor: Acer
dmi.bios.version: R01-A2
dmi.board.name: EQ45M
dmi.board.vendor: Acer
dmi.chassis.type: 3
dmi.chassis.vendor: Acer
dmi.modalias: dmi:bvnAcer:bvrR01-A2:bd11/20/2008:svnAcer:pnVeritonM670G/M670:pvr:rvnAcer:rnEQ45M:rvr:cvnAcer:ct3:cvr:
dmi.product.name: Veriton M670G/M670
dmi.sys.vendor: Acer

Tags:

Revision history for this message

David Erosa (erosa) wrote on 2010-04-30:

BootDmesg.txt Edit (42.5 KiB, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (3.0 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (4.5 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (11.2 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (625 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (3.0 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (2.6 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (2.3 KiB, text/plain; charset="utf-8")
SimpleScanLog.txt Edit (279 bytes, text/plain; charset="utf-8")
UdevDb.txt Edit (107.5 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (213.1 KiB, text/plain; charset="utf-8")

Revision history for this message

David Erosa (erosa) wrote on 2010-05-06:

I think this may be related directly to SANE, as othre applications as xsane and scanimage show the same behavior.

Also, this happens regardless the scanner is connected or not.

Revision history for this message

waldek (waldek-chrzan) wrote on 2010-05-10:

After removing "/usr/lib/sane/libsane-epson2*" xsane working ok but not detect my Epson scanner. Affected library is "libsane-epson2.so.1.0.20".

Revision history for this message

Gotit (sca957) wrote on 2010-05-17:

I'm getting the same problem but only when my wireless network connection is active. The scanning GUI pops up for about 1 second and then aborts. If I turn-off wireless then scanning behaves normally using:
simple-scan
xsane
iscan

Also, if I launch a scanning GUI while wireless is down, and then bring my wireless connection up scanning works normally. However, if I close the scanning GUI and try to launch it again the GUI will abort each time until I deactivate my wireless network connection.
Running
-Version-
Kernel : Linux 2.6.32-22-generic (x86_64)
Distribution : Ubuntu 10.04 LTS

While Wireless is active I get:
$simple-scan -d
** (simple-scan:2878): DEBUG: Starting Simple Scan 1.0.2, PID=2878
** (simple-scan:2878): DEBUG: Restoring window to 600x400 pixels
** (simple-scan:2878): DEBUG: sane_init () -> SANE_STATUS_GOOD
** (simple-scan:2878): DEBUG: SANE version 1.0.20
** (simple-scan:2878): DEBUG: Requesting redetection of scan devices
** (simple-scan:2878): DEBUG: Processing request
*** buffer overflow detected ***: simple-scan terminated

Revision history for this message

David Erosa (erosa) wrote on 2010-05-18:

I think Nicolas Valcarcel found the problem and is preparing a patch. He found that the problem is with network devices with a too long name, that causes the overflow, tha't why it only happens with the wifi connected.

Revision history for this message

David Erosa (erosa) wrote on 2010-05-18:

This bug affects all the programs using sane, so I reassign it to sane-backends.

affects:	simple-scan (Ubuntu) → sane-backends (Ubuntu)
Changed in sane-backends (Ubuntu):
status:	New → Confirmed

Revision history for this message

Shurick Daryin (daryin) wrote on 2010-05-18:

I commented the last line
net autodiscovery
in the file /etc/sane.d/epson2.conf
After that it works.

Revision history for this message

David Erosa (erosa) wrote on 2010-05-19:

Here is Nicola's patch:

https://alioth.debian.org/tracker/?func=detail&atid=410366&aid=312494&group_id=30186

I upoaded a patched sane-backends package to our PPA:

https://launchpad.net/~cgateam/+archive/ppa

Feel free to test it and report if it fixes the error.

Revision history for this message

waldek (waldek-chrzan) wrote on 2010-05-19:

Hi David!

After installing this patch, my scanner working perfectly!

Thx

Revision history for this message

David Ayers (ayers) wrote on 2010-05-19:

#10

FWIW: the second patch
https://alioth.debian.org/tracker/download.php/30186/410366/312494/3788/epson2.c.patch
seems to remove a local variable "name". So if it compiles and works it could be clobbering a global variable named 'name' that happens to be visible to the compiler... but maybe I'm missing something else.

Revision history for this message

David Erosa (erosa) wrote on 2010-05-19:

#11

David, you're right.

I didn't apply the patch as uploaded, I made this change:

- name = malloc(sizeof(char) * size);
+ char *name = malloc(sizeof(char) * size);

Otherwise, it wouldn't compile.

David Erosa (erosa) on 2010-05-19

summary:

- Simple scan crashes with "buffer overflow detected"
+ Sane lib crashes with "buffer overflow detected"

Revision history for this message

Fred Saunier (fsaunier) wrote on 2011-02-23:

#12

I'm on Lucid i386 on my netbook, using a wireless connection. I have applied the patch from the ppa (post #8). From my end, there is progress in the way that xsane now recognizes the scanner (Epson CX11NF aka LP-A500) and starts (ie: no more buffer overflows). But I'm getting an IO error while trying to scan. I've also tried renaming wlan0 to eth1 (referring to post #5), but to no avail.

I'm on Maverick amd64 on my desktop, where no patch is applied. NIC is eth0, and there's no wireless attached. I'm again getting a buffer overflow when trying to reach the scanner through the network. The only workaround is to plug it through usb AND commenting out "net autodiscovery" or "net 192.168.x.y.z" in epson2.conf.

Revision history for this message

Christian Plenagl (christian-plenagl) wrote on 2011-02-24:

#13

Hi, same for me, installed the patch, but still get an: scanimage: sane_read: Error during device I/O
when I try to scan via copper network.

Thanks

Christian

Revision history for this message

Frans (v-heitkamp) wrote on 2011-03-02:

#14

In my case the sugestion of Shurick Daryin did the job. So meenting out the net autodiscovery
in the file /etc/sane.d/epson2.conf file did the job. Now it works fine.

Thanks

Revision history for this message

Noran Azmy (noran-azmy) wrote on 2011-03-30:

#15

Hello,

I am not a Linux expert, I just have Ubuntu installed and an Epson all-in-one PX720WD. As soon as I installed the printer driver here: http://avasys.jp/eng/linux_driver/download/lsb/epson-inkjet/escp/, the printing function worked, but the scanning didn't. Both "Simple Scan" and "Image Scan!" terminate with a buffer overflow. I was inspired by one of the posts and deleted /usr/lib/sane/libsane-epson2*. Worked like a charm.

Best,

Noran

Revision history for this message

Michael Nagel (nailor) wrote on 2011-12-02:

#16

Closing Simple Scan Task

Changed in simple-scan:
status:	New → Invalid

Revision history for this message

Yves Bertheau (yves-bertheau-9) wrote on 2012-01-06:

#17

xsane and simple scan were running perfectly when using my HP 2840 multifunction printer.

After I added an USB Epson printer I was unable to again scan files from the HP multifunction printer. I also had the same buffer overflow, etc.

As previously noted by Shurick Daryin (daryin) on 2010-05-18: I also commented the "net autodiscovery" line of /etc/sane.d/epson2.conf.

It is again working perfectly.

Thanks to all and congratulations to Shurick for having found this very difficult to find source of error (I spent hours before making such a link between the 2 printers).

Yves

David Ward (dpward) on 2022-03-27

Changed in sane-backends (Ubuntu):
status:	Confirmed → Invalid

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

auto-alioth.debian.org #312494 Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntusane-backends package

Sane lib crashes with "buffer overflow detected"

Bug Description

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
sane-backends package