Most_Mini_Buf can overflow

[gavinwy]

I discovered that with the Arch Linux build of most, it can be made to buffer overflow by trying to search more than 140 or so characters. This is caught by Arch building with the _FORTIFY_SOURCE=3 glibc macro. It doesn't result in a crash without the _FORTIFY_SOURCE=3 macro used, but I believe the overflow still happens when using the Makefile from upstream most, but it doesn't result in a crash in that instance.

There is discussion about this in the Arch bug tracker, where people suspect it's strcpy overflowing a Most_Mini_Buf here. There are core dumps and gdb backtraces there too.

[lowerclasswarfare]

I had just discovered the same thing today while browsing some manpages with most as my pager. MOST version 5.2.0 (S-Lang version 2.3.3)

I wanted to look up if this was documented or not, and this was the first report I found. I am on Gentoo Linux.

[gavinwy]

It's been fixed in git, but a release with the fix isn't out yet. If you look at the link to the arch bug tracker above, there are patches someone has made for 5.2.0 that might help you patch it before you compile, since I'm assuming you're compiling from source since you're on Gentoo. Or you could try using the lastest version from GitHub instead of 5.2.0 and building that. I'm not super familiar with portage, but I hope this helps.

…

-------- Original Message --------

On 10/8/25 1:14 PM, zerg wrote: lowerclasswarfare left a comment [(jedsoft/most#29)](#29 (comment)) I had just discovered the same thing today while browsing some manpages with most as my pager. MOST version 5.2.0 (S-Lang version 2.3.3) I wanted to look up if this was documented or not, and this was the first report I found. I am on Gentoo Linux. — Reply to this email directly, [view it on GitHub](#29 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AH6SGXD34B7IOFZN3C66LBL3WVWCBAVCNFSM6AAAAACAXQZV4GVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGOBTGA3DQOJZG4). You are receiving this because you authored the thread.Message ID: ***@***.***>

[lowerclasswarfare]

It's been fixed in git, but a release with the fix isn't out yet. If you look at the link to the arch bug tracker above, there are patches someone has made for 5.2.0 that might help you patch it before you compile, since I'm assuming you're compiling from source since you're on Gentoo. Or you could try using the lastest version from GitHub instead of 5.2.0 and building that. I'm not super familiar with portage, but I hope this helps.
…

Yeah I was looking up if there were any fixes and found those. I'm creating a bug report on Gentoo's bug tracker, and maybe the devs will look at it.

It's totally possible to edit ebuilds through portage, but it's sort of a pain if you don't know how to write your own or create a personal overlay. I'll give it a shot with the git branch and throw some text at it.

Thanks.