bin/60943: atto: format string injection (replace.c:49)

["kilian.feess%posteo.de@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60943
>Category:       bin
>Synopsis:       atto: format string injection (replace.c:49)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 30 01:10:00 +0000 2026
>Originator:     Kilian Feess
>Release:        NetBSD-current version 11.99.9
>Organization:
>Environment:
Linux CelsiusM770 7.0.0-42-generic #42-Ubuntu SMP PREEMPT_DYNAMIC Thu Oct 15 08:06:44 UTC 2026 x86_64 GNU/Linux

>Description:
format string injection in replace.c

replace.c:39
snprintf(question, sizeof(question), "Replace '%s' with '%s' ? ", searchtext, replace);

replace.c:41
msg(question);

If searchtext or replace contain format strings, they are executed in msg.

Second issue:
main.c:126 msg()
It applies an unbounded vsprintf - a format string like %999d would write ~10kb of data

Upstream is affected, too.

These reports I sent were the most significant bugs. There are some smaller ones left. I would recommend to use an LLM and ask something like "do a security audit of this code base and make a list of your findings" to weed the rest out.

I found the first issue when building and running the editor on Linux to try it out, the default setting of _FORTIFY_SOURCE and decided to dig for more issues.
>How-To-Repeat:
./atto
%x # type %x move cursor to the front of the line
# Esc-r
# replace %x [enter] with %p
# you should see some stack contents
>Fix:
change replace.c:41 to

msg("%s", question);

and main.c:130 to

(void) vsnprintf(msgline, sizeof(msgline), msg, args);