** Description changed: Binary package hint: tspc - The gw6c daemon will crash on start. When I rebuild the gw6c package - with debug symbols, I no longer get a crash. However, doing this also - turned compiler optimizations off. - $ lsb_release -rd - Description: Ubuntu karmic (development branch) + Description: Ubuntu 9.10 Release: 9.10 $ apt-cache policy gw6c gw6c: - Installé : 6.0.1dfsg.1-3 - Candidat : 6.0.1dfsg.1-3 - Table de version : - *** 6.0.1dfsg.1-3 0 - 500 http://archive.ubuntu.com karmic/universe Packages - 100 /var/lib/dpkg/status + Installé : 6.0.1dfsg.1-3 + Candidat : 6.0.1dfsg.1-3 + Table de version : + *** 6.0.1dfsg.1-3 0 + 500 http://archive.ubuntu.com karmic/universe Packages + 100 /var/lib/dpkg/status - $ sudo /usr/sbin/gw6c - *** buffer overflow detected ***: /usr/sbin/gw6c terminated - ======= Backtrace: ========= - /lib/libc.so.6(__fortify_fail+0x37)[0x7f5cb2207437] - /lib/libc.so.6[0x7f5cb22063e0] - /usr/sbin/gw6c[0x421496] - /usr/sbin/gw6c[0x41d1d3] - /usr/sbin/gw6c[0x41815a] - /usr/sbin/gw6c[0x405bc4] - /usr/sbin/gw6c[0x405fb0] - /usr/sbin/gw6c[0x410d27] - /lib/libc.so.6(__libc_start_main+0xfd)[0x7f5cb212eacd] - /usr/sbin/gw6c[0x404ea9] - ======= Memory map: ======== - 00400000-00430000 r-xp 00000000 fc:00 86668 /usr/sbin/gw6c - 0062f000-00630000 r--p 0002f000 fc:00 86668 /usr/sbin/gw6c - 00630000-00632000 rw-p 00030000 fc:00 86668 /usr/sbin/gw6c - 00632000-00647000 rw-p 00000000 00:00 0 - 01c80000-01ca1000 rw-p 00000000 00:00 0 [heap] - 7f5cb1a70000-7f5cb1af2000 r-xp 00000000 fc:00 3145761 /lib/libm-2.10.1.so - 7f5cb1af2000-7f5cb1cf2000 ---p 00082000 fc:00 3145761 /lib/libm-2.10.1.so - 7f5cb1cf2000-7f5cb1cf3000 r--p 00082000 fc:00 3145761 /lib/libm-2.10.1.so - 7f5cb1cf3000-7f5cb1cf4000 rw-p 00083000 fc:00 3145761 /lib/libm-2.10.1.so - 7f5cb1cf4000-7f5cb1d0a000 r-xp 00000000 fc:00 3145774 /lib/libz.so.1.2.3.3 - 7f5cb1d0a000-7f5cb1f0a000 ---p 00016000 fc:00 3145774 /lib/libz.so.1.2.3.3 - 7f5cb1f0a000-7f5cb1f0b000 r--p 00016000 fc:00 3145774 /lib/libz.so.1.2.3.3 - 7f5cb1f0b000-7f5cb1f0c000 rw-p 00017000 fc:00 3145774 /lib/libz.so.1.2.3.3 - 7f5cb1f0c000-7f5cb1f0e000 r-xp 00000000 fc:00 3145760 /lib/libdl-2.10.1.so - 7f5cb1f0e000-7f5cb210e000 ---p 00002000 fc:00 3145760 /lib/libdl-2.10.1.so - 7f5cb210e000-7f5cb210f000 r--p 00002000 fc:00 3145760 /lib/libdl-2.10.1.so - 7f5cb210f000-7f5cb2110000 rw-p 00003000 fc:00 3145760 /lib/libdl-2.10.1.so - 7f5cb2110000-7f5cb2276000 r-xp 00000000 fc:00 3145746 /lib/libc-2.10.1.so - 7f5cb2276000-7f5cb2475000 ---p 00166000 fc:00 3145746 /lib/libc-2.10.1.so - 7f5cb2475000-7f5cb2479000 r--p 00165000 fc:00 3145746 /lib/libc-2.10.1.so - 7f5cb2479000-7f5cb247a000 rw-p 00169000 fc:00 3145746 /lib/libc-2.10.1.so - 7f5cb247a000-7f5cb247f000 rw-p 00000000 00:00 0 - 7f5cb247f000-7f5cb2499000 r-xp 00000000 fc:00 229630 /lib/libgcc_s.so.1 - 7f5cb2499000-7f5cb2698000 ---p 0001a000 fc:00 229630 /lib/libgcc_s.so.1 - 7f5cb2698000-7f5cb2699000 r--p 00019000 fc:00 229630 /lib/libgcc_s.so.1 - 7f5cb2699000-7f5cb269a000 rw-p 0001a000 fc:00 229630 /lib/libgcc_s.so.1 - 7f5cb269a000-7f5cb278a000 r-xp 00000000 fc:00 83848 /usr/lib/libstdc++.so.6.0.12 - 7f5cb278a000-7f5cb298a000 ---p 000f0000 fc:00 83848 /usr/lib/libstdc++.so.6.0.12 - 7f5cb298a000-7f5cb2991000 r--p 000f0000 fc:00 83848 /usr/lib/libstdc++.so.6.0.12 - 7f5cb2991000-7f5cb2993000 rw-p 000f7000 fc:00 83848 /usr/lib/libstdc++.so.6.0.12 - 7f5cb2993000-7f5cb29a8000 rw-p 00000000 00:00 0 - 7f5cb29a8000-7f5cb29bf000 r-xp 00000000 fc:00 3145772 /lib/libpthread-2.10.1.so - 7f5cb29bf000-7f5cb2bbe000 ---p 00017000 fc:00 3145772 /lib/libpthread-2.10.1.so - 7f5cb2bbe000-7f5cb2bbf000 r--p 00016000 fc:00 3145772 /lib/libpthread-2.10.1.so - 7f5cb2bbf000-7f5cb2bc0000 rw-p 00017000 fc:00 3145772 /lib/libpthread-2.10.1.so - 7f5cb2bc0000-7f5cb2bc4000 rw-p 00000000 00:00 0 - 7f5cb2bc4000-7f5cb2d24000 r-xp 00000000 fc:00 3145863 /lib/libcrypto.so.0.9.8 - 7f5cb2d24000-7f5cb2f24000 ---p 00160000 fc:00 3145863 /lib/libcrypto.so.0.9.8 - 7f5cb2f24000-7f5cb2f31000 r--p 00160000 fc:00 3145863 /lib/libcrypto.so.0.9.8 - 7f5cb2f31000-7f5cb2f47000 rw-p 0016d000 fc:00 3145863 /lib/libcrypto.so.0.9.8 - 7f5cb2f47000-7f5cb2f4b000 rw-p 00000000 00:00 0 - 7f5cb2f4b000-7f5cb2f6a000 r-xp 00000000 fc:00 3145737 /lib/ld-2.10.1.so - 7f5cb3135000-7f5cb313a000 rw-p 00000000 00:00 0 - 7f5cb3166000-7f5cb3169000 rw-p 00000000 00:00 0 - 7f5cb3169000-7f5cb316a000 r--p 0001e000 fc:00 3145737 /lib/ld-2.10.1.so - 7f5cb316a000-7f5cb316b000 rw-p 0001f000 fc:00 3145737 /lib/ld-2.10.1.so - 7fff6ff62000-7fff6ff77000 rw-p 00000000 00:00 0 [stack] - 7fff6ffff000-7fff70000000 r-xp 00000000 00:00 0 [vdso] - ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] + How to reproduce: + 0. Run Ubuntu on a 64-bit architecture. + 1. Edit the configuration in /etc/gw6c/gw6c.conf by setting the "client_v4" parameter to an IP address. + 2. Restart the gw6c daemon. + 3. Check that the gw6c daemon is running. + + The gw6c daemon crashes when started if the client_v4 is set to an IP + address instead of the default value of "auto". The reason is a buffer + overflow caused by a memcpy from an integer with a length that is + dependent of the architecture to an inet_addr(3) structure that is + always 32-bit long.
** Description changed: Binary package hint: tspc $ lsb_release -rd Description: Ubuntu 9.10 Release: 9.10 $ apt-cache policy gw6c gw6c: Installé : 6.0.1dfsg.1-3 Candidat : 6.0.1dfsg.1-3 Table de version : *** 6.0.1dfsg.1-3 0 500 http://archive.ubuntu.com karmic/universe Packages 100 /var/lib/dpkg/status How to reproduce: 0. Run Ubuntu on a 64-bit architecture. 1. Edit the configuration in /etc/gw6c/gw6c.conf by setting the "client_v4" parameter to an IP address. 2. Restart the gw6c daemon. 3. Check that the gw6c daemon is running. The gw6c daemon crashes when started if the client_v4 is set to an IP address instead of the default value of "auto". The reason is a buffer overflow caused by a memcpy from an integer with a length that is - dependent of the architecture to an inet_addr(3) structure that is - always 32-bit long. + dependent of the architecture to an inet_addr_t structure that is always + 32-bit long. -- gw6c crashes with buffer overflow on start https://bugs.launchpad.net/bugs/418176 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
