Heap Buffer Overflow in Midnight Commander Listing Format Editor

[RCydefe]

Is there an existing issue for this?

• I have searched the existing issues

Midnight Commander version and build configuration

4.8.33 (commit f03e97f25, and likely all prior versions)

Operating system

Linux Kali 6.19.14

Is this issue reproducible using the latest version of Midnight Commander?

• I confirm the issue is still reproducible with the latest version of Midnight Commander

How to reproduce

Write a listing_format entry to panels.ini — requires write access to
~/.config/mc/panels.ini (same privilege level as MC itself). This can be achieved
via social engineering (malicious archive extraction) or by another vulnerability
that writes files to the user's config directory.

2. Victim opens the listing format editor — presses Alt+t in MC. The dialog
   pre-populates with the crafted items. The overflow occurs immediately when the user
   presses OK, even if they do not modify any selections.

Expected behavior

No crash

Actual behavior

the heap corruption manifests as a crash on any subsequent heap operation, typically within the same dialog handler or shortly after.

Additional context

A heap buffer overflow vulnerability exists in the listing mode format editor
(listmode_edit() / collect_new_format()) when a user opens the listing format
dialog (Alt+t) with a crafted listing_format value in panels.ini.

The function collect_new_format() (listmode.c:297) allocates a fixed 1024-byte heap
buffer and then concatenates all selected format items into it using repeated strcat()
calls — with no bounds check against the allocated size. If the total length of the
concatenated format items exceeds 1024 bytes, strcat writes past the end of the heap
allocation, corrupting heap metadata and adjacent memory.

[mc-worker]

Listing format editor (listmode.c) is unmaintained and actually unsupported and not compiled. It should be just removed.

[zyv]

Oh, I didn't even know that it existed. Apparently, it was introduced in 3263fee, but never actually "finished" (is the software ever finished?).

Listing format editor (listmode.c) is unmaintained and actually unsupported and not compiled. It should be just removed.

@mc-worker I agree, but why did you close this ticket? Are you planning to remove it in some other ticket? I would actually keep this ticket open and submit a PR to remove the listing format editor.