[MacPorts] #74183: outguess 0.4: -e (error correction) crashes with SIGABRT / stack smashing detected in steg_adjust_errors

[MacPorts]

#74183: outguess 0.4: -e (error correction) crashes with SIGABRT / stack smashing
detected in steg_adjust_errors
------------------------+----------------------
 Reporter:  HybridBits  |      Owner:  (none)
     Type:  defect      |     Status:  new
 Priority:  Normal      |  Milestone:
Component:  ports       |    Version:
 Keywords:              |       Port:  outguess
------------------------+----------------------
 '''Port:''' outguess
 '''Port version:''' 0.4
 '''macOS version:''' macOS Sequoia 15.7.7
 '''Xcode version:''' 16.2
 '''Architecture:''' arm64 (Apple Silicon)

 == Summary ==

 outguess reliably crashes with SIGABRT (stack smashing / __stack_chk_fail)
 whenever the -e (error-correcting encoding) flag is used during embedding.
 The crash occurs inside steg_adjust_errors, part of the Golay error-
 correction code path. Output is left as a 0-byte file.

 I compared this against a separately-built outguess 0.2 binary (bundled
 with a third-party macOS app, built from what appears to be the original
 2001 Niels Provos source) run against the identical image and message on
 the same machine — that build completes successfully with -e. Only the
 MacPorts-packaged 0.4 build crashes, which points to something in the
 0.3/0.4 codebase (or how this port builds it) rather than an environment
 or usage issue.

 == Steps to reproduce ==

 {{{
 outguess -k testkey -e -p 85 -x 10 -s 1 -i 1000 -F- -d dataset.txt
 check.jpg out.jpg
 }}}

 (dataset.txt is any small text file, a few dozen bytes is enough to
 reproduce; check.jpg is any ordinary JPEG.)

 == Expected behavior ==

 Embedding completes normally, e.g.:

 {{{
 Initialize encoding/decoding tables
 Reading check.jpg....
 JPEG compression quality set to 85
 Extracting usable bits: 49398 bits
 Encoded 'dataset.txt' with ECC: 184 bits, 23 bytes
 Finding best embedding...
 0: 7467(50.6%)[50.8%], bias 8137(1.09), saved: -13, total: 18.64%
 ...
 Bits embedded: ...
 Storing bitmap into data...
 Writing out.jpg....
 }}}

 == Actual behavior ==

 Process aborts immediately after "Finding best embedding...", before any
 embedding-progress lines print. out.jpg is created but is 0 bytes.

 {{{
 Initialize encoding/decoding tables
 Reading check.jpg....
 JPEG compression quality set to 85
 Extracting usable bits:   49398 bits
 Encoded 'dataset.txt' with ECC: 184 bits, 23 bytes
 Finding best embedding...
 Process ... stopped


 thread #1, stop reason = signal SIGABRT
 }}}


 Exit status observed via NSTask/shell: 6 (SIGABRT).

 == Backtrace (lldb) ==

 {{{


 thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT

 frame #0: libsystem_kernel.dylib__pthread_kill + 8 frame #1:
 libsystem_pthread.dylibpthread_kill + 296
 frame #2: libsystem_c.dylib__abort + 132 frame #3:
 libsystem_c.dylib__stack_chk_fail + 96
 frame #4: outguesssteg_adjust_errors + 740 frame #5:
 outguesssteg_embedchunk + 128
 frame #6: outguesssteg_embed + 248 frame #7: outguesssteg_find + 320
 frame #8: outguessdo_embed + 332 frame #9: outguessmain + 1580
 frame #10: dyld`start + 6076
 }}}





 __stack_chk_fail indicates the stack protector detected a corrupted stack
 canary — i.e. a stack buffer overflow — inside steg_adjust_errors. This is
 a real memory-safety bug, not a false positive.

 == Notes on where else this has been reported ==

 Upstream (resurrecting-open-source-projects/outguess on GitHub) was
 archived by its owner on 2025-09-20 and is now read-only; no new issues
 can be filed there. Filing here instead since this affects the MacPorts-
 distributed build specifically and upstream is no longer reachable.

-- 
Ticket URL: <https://trac.macports.org/ticket/74183>
MacPorts <https://www.macports.org/>
Ports system for macOS