[Chicken-users] [SECURITY] Potential buffer overrun in string-translate*

[Peter Bex]

Hello CHICKEN users,

Using gcc's Address Sanitizer, it was discovered that the string-translate*
procedure from the data-structures unit can scan beyond the input string's
length up to the length of the source strings in the map that's passed to
string-translate*.  This issue was fixed in master 8a46020, and it will
make its way into CHICKEN 4.10.

This bug is present in all released versions of CHICKEN.

There is no known workaround, except applying the patch posted in the
following chicken-hackers thread:
http://lists.nongnu.org/archive/html/chicken-hackers/2015-06/msg00037.html

Kind regards,
The CHICKEN Team

signature.asc
Description: Digital signature