bin/60942: atto: stack buffer overflow on filename completion

["kilian.feess%posteo.de@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60942
>Category:       bin
>Synopsis:       atto: stack buffer overflow on filename completion
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 30 00:25:00 +0000 2026
>Originator:     Kilian Feess
>Release:        NetBSD-current (11.99.9), src/usr.bin/atto as of 2026-10-30
>Organization:
>Environment:
Linux CelsiusM770 7.0.0-42-generic #42-Ubuntu SMP PREEMPT_DYNAMIC Thu Oct 15 08:06:44 UTC 2026 x86_64 GNU/Linux

>Description:
char sys_command[255] in complete.c:12 is built by

completion.c:52
strcpy(sys_command, "echo ");
strcat(sys_command, buf);
if (!iswild) strcat(sys_command, "*");
strcat(sys_command, " >");
strcat(sys_command, temp_file);
strcat(sys_command, " 2>&1");
>How-To-Repeat:
python3 -c "print('a'*254)" # copy the output to your clipboard

# build atto with address sanitizer
./atto-asan
# C-x C-f
# paste your clipboard
# press tab

something like this should appear:

ERROR: AddressSanitizer: stack-buffer-overflow WRITE of size 1 at ...
    #0 strcat ... complete.c:58 in getfilename
    Frame: 'sys_command' ... <offset 255> is located 0 bytes inside of
    255-byte region [frame]
>Fix:
similar to my last report, use glob.h for in-process completion. This removes this whole code path.