Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Buffer overflow when built on Ubuntu 24.04 x86_64 #811

Open
ExplodingLemur opened this issue Jun 20, 2024 · 3 comments · May be fixed by #812
Open

Buffer overflow when built on Ubuntu 24.04 x86_64 #811

ExplodingLemur opened this issue Jun 20, 2024 · 3 comments · May be fixed by #812

Comments

@ExplodingLemur
Copy link

When I build from the master branch (commit 3f2a5d7) it immediately throws a buffer overflow error and dumps core. This is an x86_64 machine running Ubuntu 24.04.
I've included output from make, gdb, and strace below. Let me know if any additional information would help.

make

explodinglemur@pocsagbox:~/MMDVMHost$ make
echo "const char *gitversion = \"3f2a5d794d9f643f5b00dad3882eedc960b7f19f\";" > GitVersion.h
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o AMBEFEC.o AMBEFEC.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o BCH.o BCH.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o AX25Control.o AX25Control.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o AX25Network.o AX25Network.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o BPTC19696.o BPTC19696.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o CASTInfo.o CASTInfo.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Conf.o Conf.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o CRC.o CRC.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Display.o Display.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRControl.o DMRControl.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRCSBK.o DMRCSBK.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRData.o DMRData.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRDataHeader.o DMRDataHeader.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRDirectNetwork.o DMRDirectNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMREMB.o DMREMB.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMREmbeddedData.o DMREmbeddedData.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRFullLC.o DMRFullLC.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRGatewayNetwork.o DMRGatewayNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRLookup.o DMRLookup.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRLC.o DMRLC.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRNetwork.o DMRNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRShortLC.o DMRShortLC.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRSlot.o DMRSlot.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRSlotType.o DMRSlotType.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRAccessControl.o DMRAccessControl.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRTA.o DMRTA.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DMRTrellis.o DMRTrellis.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DStarControl.o DStarControl.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DStarHeader.o DStarHeader.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DStarNetwork.o DStarNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o DStarSlowData.o DStarSlowData.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o FMControl.o FMControl.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o FMNetwork.o FMNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Golay2087.o Golay2087.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Golay24128.o Golay24128.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Hamming.o Hamming.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o I2CController.o I2CController.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o IIRDirectForm1Filter.o IIRDirectForm1Filter.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o LCDproc.o LCDproc.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Log.o Log.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o M17Control.o M17Control.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o M17Convolution.o M17Convolution.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o M17CRC.o M17CRC.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o M17LSF.o M17LSF.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o M17Network.o M17Network.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o M17Utils.o M17Utils.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o MMDVMHost.o MMDVMHost.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Modem.o Modem.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o ModemPort.o ModemPort.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o ModemSerialPort.o ModemSerialPort.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Mutex.o Mutex.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NetworkInfo.o NetworkInfo.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Nextion.o Nextion.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NullController.o NullController.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NullDisplay.o NullDisplay.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNAudio.o NXDNAudio.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNControl.o NXDNControl.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNConvolution.o NXDNConvolution.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNCRC.o NXDNCRC.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNFACCH1.o NXDNFACCH1.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNIcomNetwork.o NXDNIcomNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNKenwoodNetwork.o NXDNKenwoodNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNLayer3.o NXDNLayer3.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNLICH.o NXDNLICH.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNLookup.o NXDNLookup.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNNetwork.o NXDNNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNSACCH.o NXDNSACCH.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o NXDNUDCH.o NXDNUDCH.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o P25Audio.o P25Audio.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o P25Control.o P25Control.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o P25Data.o P25Data.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o P25LowSpeedData.o P25LowSpeedData.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o P25Network.o P25Network.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o P25NID.o P25NID.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o P25Trellis.o P25Trellis.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o P25Utils.o P25Utils.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o PseudoTTYController.o PseudoTTYController.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o POCSAGControl.o POCSAGControl.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o POCSAGNetwork.o POCSAGNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o QR1676.o QR1676.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o RemoteControl.o RemoteControl.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o RS129.o RS129.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o RS241213.o RS241213.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o RSSIInterpolator.o RSSIInterpolator.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o SerialPort.o SerialPort.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o SMeter.o SMeter.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o StopWatch.o StopWatch.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Sync.o Sync.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o SHA256.o SHA256.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o TFTSurenoo.o TFTSurenoo.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Thread.o Thread.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Timer.o Timer.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o UARTController.o UARTController.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o UDPController.o UDPController.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o UDPSocket.o UDPSocket.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o UserDB.o UserDB.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o UserDBentry.o UserDBentry.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o Utils.o Utils.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o YSFControl.o YSFControl.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o YSFConvolution.o YSFConvolution.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o YSFFICH.o YSFFICH.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o YSFNetwork.o YSFNetwork.cpp
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o YSFPayload.o YSFPayload.cpp
c++ AMBEFEC.o BCH.o AX25Control.o AX25Network.o BPTC19696.o CASTInfo.o Conf.o CRC.o Display.o DMRControl.o DMRCSBK.o DMRData.o DMRDataHeader.o DMRDirectNetwork.o DMREMB.o DMREmbeddedData.o DMRFullLC.o DMRGatewayNetwork.o DMRLookup.o DMRLC.o DMRNetwork.o DMRShortLC.o DMRSlot.o DMRSlotType.o DMRAccessControl.o DMRTA.o DMRTrellis.o DStarControl.o DStarHeader.o DStarNetwork.o DStarSlowData.o FMControl.o FMNetwork.o Golay2087.o Golay24128.o Hamming.o I2CController.o IIRDirectForm1Filter.o LCDproc.o Log.o M17Control.o M17Convolution.o M17CRC.o M17LSF.o M17Network.o M17Utils.o MMDVMHost.o Modem.o ModemPort.o ModemSerialPort.o Mutex.o NetworkInfo.o Nextion.o NullController.o NullDisplay.o NXDNAudio.o NXDNControl.o NXDNConvolution.o NXDNCRC.o NXDNFACCH1.o NXDNIcomNetwork.o NXDNKenwoodNetwork.o NXDNLayer3.o NXDNLICH.o NXDNLookup.o NXDNNetwork.o NXDNSACCH.o NXDNUDCH.o P25Audio.o P25Control.o P25Data.o P25LowSpeedData.o P25Network.o P25NID.o P25Trellis.o P25Utils.o PseudoTTYController.o POCSAGControl.o POCSAGNetwork.o QR1676.o RemoteControl.o RS129.o RS241213.o RSSIInterpolator.o SerialPort.o SMeter.o StopWatch.o Sync.o SHA256.o TFTSurenoo.o Thread.o Timer.o UARTController.o UDPController.o UDPSocket.o UserDB.o UserDBentry.o Utils.o YSFControl.o YSFConvolution.o YSFFICH.o YSFNetwork.o YSFPayload.o -g -L/usr/local/lib -lpthread -lutil -o MMDVMHost
c++ -g -O3 -Wall -std=c++0x -pthread -DHAVE_LOG_H -I/usr/local/include -c -o RemoteCommand.o RemoteCommand.cpp
c++ Log.o RemoteCommand.o UDPSocket.o -g -L/usr/local/lib -lpthread -lutil -o RemoteCommand

gdb

explodinglemur@pocsagbox:~/MMDVMHost$ gdb ./MMDVMHost
GNU gdb (Ubuntu 15.0.50.20240403-0ubuntu1) 15.0.50.20240403-git
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./MMDVMHost...
(gdb) set follow-fork-mode child
(gdb) run ./MMDVM.ini
Starting program: /home/explodinglemur/MMDVMHost/MMDVMHost ./MMDVM.ini

This GDB supports auto-downloading debuginfo from the following URLs:
  <https://debuginfod.ubuntu.com>
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
Downloading separate debug info for system-supplied DSO at 0x7ffff7fc3000
Downloading separate debug info for /lib/x86_64-linux-gnu/libstdc++.so.6
Downloading separate debug info for /lib/x86_64-linux-gnu/libgcc_s.so.1
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
*** buffer overflow detected ***: terminated

Program received signal SIGABRT, Aborted.
Download failed: Invalid argument.  Continuing without source file ./nptl/./nptl/pthread_kill.c.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
warning: 44     ./nptl/pthread_kill.c: No such file or directory
(gdb) continue
Continuing.

Program terminated with signal SIGABRT, Aborted.
The program no longer exists.
(gdb)

strace

explodinglemur@pocsagbox:~/MMDVMHost$ strace -f ./MMDVMHost ./MMDVM.ini
execve("./MMDVMHost", ["./MMDVMHost", "./MMDVM.ini"], 0x7ffe81c33ba0 /* 24 vars */) = 0
brk(NULL)                               = 0x5c7c429ff000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x72b15eeea000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=29059, ...}) = 0
mmap(NULL, 29059, PROT_READ, MAP_PRIVATE, 3, 0) = 0x72b15eee2000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libstdc++.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=2592144, ...}) = 0
mmap(NULL, 2605376, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x72b15ec00000
mmap(0x72b15ec9d000, 1310720, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9d000) = 0x72b15ec9d000
mmap(0x72b15eddd000, 581632, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1dd000) = 0x72b15eddd000
mmap(0x72b15ee6b000, 57344, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x26b000) = 0x72b15ee6b000
mmap(0x72b15ee79000, 12608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x72b15ee79000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=952616, ...}) = 0
mmap(NULL, 950296, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x72b15eb17000
mmap(0x72b15eb27000, 520192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10000) = 0x72b15eb27000
mmap(0x72b15eba6000, 360448, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8f000) = 0x72b15eba6000
mmap(0x72b15ebfe000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe7000) = 0x72b15ebfe000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=182944, ...}) = 0
mmap(NULL, 181160, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x72b15eeb5000
mmap(0x72b15eeb9000, 143360, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x72b15eeb9000
mmap(0x72b15eedc000, 16384, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x27000) = 0x72b15eedc000
mmap(0x72b15eee0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2b000) = 0x72b15eee0000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\243\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
fstat(3, {st_mode=S_IFREG|0755, st_size=2125328, ...}) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 2170256, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x72b15e800000
mmap(0x72b15e828000, 1605632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x72b15e828000
mmap(0x72b15e9b0000, 323584, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b0000) = 0x72b15e9b0000
mmap(0x72b15e9ff000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1fe000) = 0x72b15e9ff000
mmap(0x72b15ea05000, 52624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x72b15ea05000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x72b15eeb3000
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x72b15eeb0000
arch_prctl(ARCH_SET_FS, 0x72b15eeb0740) = 0
set_tid_address(0x72b15eeb0a10)         = 56321
set_robust_list(0x72b15eeb0a20, 24)     = 0
rseq(0x72b15eeb1060, 0x20, 0, 0x53053053) = 0
mprotect(0x72b15e9ff000, 16384, PROT_READ) = 0
mprotect(0x72b15eee0000, 4096, PROT_READ) = 0
mprotect(0x72b15ebfe000, 4096, PROT_READ) = 0
mprotect(0x72b15ee6b000, 45056, PROT_READ) = 0
mprotect(0x5c7c42739000, 8192, PROT_READ) = 0
mprotect(0x72b15ef22000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x72b15eee2000, 29059)           = 0
futex(0x72b15ee797bc, FUTEX_WAKE_PRIVATE, 2147483647) = 0
getrandom("\x17\x2a\xa5\x5a\x29\x78\x82\x16", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x5c7c429ff000
brk(0x5c7c42a20000)                     = 0x5c7c42a20000
rt_sigaction(SIGINT, {sa_handler=0x5c7c42697670, sa_mask=[INT], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x72b15e845320}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGTERM, {sa_handler=0x5c7c42697670, sa_mask=[TERM], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x72b15e845320}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGHUP, {sa_handler=0x5c7c42697670, sa_mask=[HUP], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x72b15e845320}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGUSR1, {sa_handler=0x5c7c42697690, sa_mask=[USR1], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x72b15e845320}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
openat(AT_FDCWD, "./MMDVM.ini", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0664, st_size=5555, ...}) = 0
read(3, "[General]\nCallsign=G9BF\nId=12345"..., 4096) = 4096
read(3, "able=1\nLocalAddress=127.0.0.1\nLo"..., 4096) = 1459
read(3, "", 4096)                       = 0
close(3)                                = 0
openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=2852, ...}) = 0
fstat(3, {st_mode=S_IFREG|0644, st_size=2852, ...}) = 0
read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0"..., 4096) = 2852
lseek(3, -1810, SEEK_CUR)               = 1042
read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\6\0\0\0\0"..., 4096) = 1810
close(3)                                = 0
openat(AT_FDCWD, "./MMDVM-2024-06-20.log", O_RDWR|O_CREAT|O_APPEND, 0666) = 3
writev(2, [{iov_base="*** ", iov_len=4}, {iov_base="buffer overflow detected", iov_len=24}, {iov_base=" ***: terminated\n", iov_len=17}], 3*** buffer overflow detected ***: terminated
) = 45
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x72b15eee9000
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
gettid()                                = 56321
getpid()                                = 56321
tgkill(56321, 56321, SIGABRT)           = 0
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=56321, si_uid=1000} ---
+++ killed by SIGABRT (core dumped) +++
Aborted (core dumped)

logs

MMDVM-2024-06-20.log is empty
@ExplodingLemur
Copy link
Author

Possible duplicate of Issue 808 but insufficient details there to know for sure.

@g4klx
Copy link
Owner

g4klx commented Jun 20, 2024 via email

@ExplodingLemur
Copy link
Author

gdb backtrace

(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff784526e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff78288ff in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff78297b6 in __libc_message_impl (fmt=fmt@entry=0x7ffff79ce765 "*** %s ***: terminated\n")
    at ../sysdeps/posix/libc_fatal.c:132
#6  0x00007ffff7936c19 in __GI___fortify_fail (msg=msg@entry=0x7ffff79ce74c "buffer overflow detected")
    at ./debug/fortify_fail.c:24
#7  0x00007ffff79365d4 in __GI___chk_fail () at ./debug/chk_fail.c:28
#8  0x00007ffff7938391 in ___vsnprintf_chk (s=<optimized out>, maxlen=maxlen@entry=500, flag=flag@entry=2,
    slen=<optimized out>,
    format=format@entry=0x555555600268 "This software is for use on amateur radio networks only,",
    ap=ap@entry=0x7fffffffd988) at ./debug/vsnprintf_chk.c:28
#9  0x0000555555594b23 in vsnprintf (__ap=0x7fffffffd988,
    __fmt=0x555555600268 "This software is for use on amateur radio networks only,", __n=500, __s=<optimized out>)
    at /usr/include/x86_64-linux-gnu/bits/stdio2.h:68
#10 Log (level=level@entry=3, fmt=0x555555600268 "This software is for use on amateur radio networks only,")
    at Log.cpp:170
#11 0x00005555555a4cf3 in CMMDVMHost::run (this=this@entry=0x5555556523e0) at MMDVMHost.cpp:295
#12 0x000055555555f239 in main (argc=<optimized out>, argv=<optimized out>) at MMDVMHost.cpp:111
(gdb)

@mx-shift mx-shift linked a pull request Jun 24, 2024 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix buffer overflow in Log mx-shift/MMDVMHost
2 participants
@ExplodingLemur @g4klx