Created attachment 629285 [details] patch to fix the buffer overflow

Description of problem: A buffer overflow in mcrypt version 2.6.8 and earlier due to long filenames. If a user were tricked into attempting to encrypt/decrypt specially crafted long filename(s), this flaw would cause a stack-based buffer overflow that could potentially lead to arbitrary code execution.

Note that this is caught by FORTIFYSOURCE, which renders this to being a crash-only bug on Fedora.

There are currently no upstream patches for this flaw.

Version-Release number of selected component (if applicable): mcrypt-2.6.8-9.el6 (possibly others too).

How reproducible: Run mcrypt with ~128 byte long file names.