View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0001227unrealircdpublic2003-09-04 16:232003-11-20 19:43
ReporterRocko Assigned Tosyzop  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Product Version3.2-beta17 
Summary0001227: Crash when start/syncing services->Server and the new channelmode +f is set.
DescriptionOk let me begin...

IRCd crashes, when:

1. I have set the new channel mode, and I start the services

2. I haven't set any +f mode, start services, rejoin, and the server sets +f because of the "modes-on-join" directive

3. I join a channel, have "modes-on-join" disabled, and the services are setting mode +f (+f *15:10) because of MLOCK (modelock)

4. the server with services links to the other hub, and there is a opened channel with channel mode +f.
Additional InformationI got some different .core files.
I will post 2 gdb outputs here.

Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libssl.so.0.9.6...done.
Loaded symbols for /usr/lib/libssl.so.0.9.6
Reading symbols from /usr/lib/libcrypto.so.0.9.6...done.
Loaded symbols for /usr/lib/libcrypto.so.0.9.6
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from src/modules/commands.so...done.
Loaded symbols for src/modules/commands.so
#0 0x08059781 in do_join (cptr=0x81dbab8, sptr=0x81db1e8, parc=2, parv=0x811a360) at channel.c:3636
3636 if (chptr->mode.floodprot && (MyClient(sptr) || sptr->serv->flags.synced) &&
(gdb) bt
#0 0x08059781 in do_join (cptr=0x81dbab8, sptr=0x81db1e8, parc=2, parv=0x811a360) at channel.c:3636
#1 0x08058c63 in m_join (cptr=0x81dbab8, sptr=0x81db1e8, parc=2, parv=0x811a360) at channel.c:3318
#2 0x08069a6b in parse (cptr=0x81dbab8, buffer=0x81dbb9c ":ChanBot JOIN", bufend=0x81dbbb6 "") at parse.c:471
#3 0x08068668 in dopacket (cptr=0x81dbab8,
    buffer=0x811ad00 ":Global B Rocko :\002[NEWS - 2003-07-29]\002 We are now supporting IPv6 client connects. Simply connect to \002irc.ipv6.
test.net\002 or to the IP \002200:8d8:81:720:0:0:0:1\002. For more informations, ask in #h"..., length=1639) at packet.c:137
#4 0x0806eb4f in read_packet (cptr=0x81dbab8, rfd=0xbffffa2c) at s_bsd.c:1443
#5 0x0806f3af in read_message (delay=1, listp=0x812e900) at s_bsd.c:1927
#6 0x08065f31 in main (argc=1, argv=0xbffffb74) at ircd.c:1387


Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libssl.so.0.9.6...done.
Loaded symbols for /usr/lib/libssl.so.0.9.6
Reading symbols from /usr/lib/libcrypto.so.0.9.6...done.
Loaded symbols for /usr/lib/libcrypto.so.0.9.6
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from src/modules/commands.so...done.
Loaded symbols for src/modules/commands.so
#0 0x08059781 in do_join (cptr=0x81df0d0, sptr=0x81e1260, parc=2, parv=0x811a360) at channel.c:3636
3636 if (chptr->mode.floodprot && (MyClient(sptr) || sptr->serv->flags.synced) &&
(gdb) bt
#0 0x08059781 in do_join (cptr=0x81df0d0, sptr=0x81e1260, parc=2, parv=0x811a360) at channel.c:3636
#1 0x08058c63 in m_join (cptr=0x81df0d0, sptr=0x81e1260, parc=2, parv=0x811a360) at channel.c:3318
#2 0x08069a6b in parse (cptr=0x81df0d0, buffer=0x81df1b4 ":ChanBot JOIN", bufend=0x81df1ce "") at parse.c:471
#3 0x08068668 in dopacket (cptr=0x81df0d0,
    buffer=0x811ad00 ":NickServ n Rocko -N 0\r\n:Global B Rocko :\002[NEWS - 2001-05-22]\002 Welcome to the \002\037Test Net\00
2\037. Please ask an \002IRC Operator\002 if you like a global vhost. For help, please ask one of the ops "..., length=1852) at packet.c:137
#4 0x0806eb4f in read_packet (cptr=0x81df0d0, rfd=0xbffffa1c) at s_bsd.c:1443
#5 0x0806f3af in read_message (delay=1, listp=0x812b240) at s_bsd.c:1927
#6 0x08065e88 in main (argc=1, argv=0xbffffb74) at ircd.c:1368
3rd party modules

Activities

syzop

2003-09-04 19:13

administrator   ~0003574

Do you mean it crashes in all 4 cases (or that you need to do that in that order)?

k, let's see :)
(in gdb, for both I guess)
p *sptr
p *chptr
p *chptr->mode.floodprot

Rocko

2003-09-04 19:26

reporter   ~0003577

Crashes in all 4 cases.
The Results are different, so I will post the 2.

1.
(gdb) p *sptr
$1 = {next = 0x81df808, prev = 0x81dfac8, hnext = 0x0, user = 0x81dfa20, serv = 0x0, lastnick = 1062703137, flags = 331904, umodes = 397344,
  from = 0x81dbfd8, fd = -256, hopcount = 1 '\001', name = "ChanBot", '\0' <repeats 56 times>, username = "unknown\0\0\0",
  info = "Bot Service", '\0' <repeats 39 times>, srvptr = 0x81dbfd8, status = 1, count = 0, oflag = 145, since = 136213224, firsttime = 0,
  lasttime = 0, last = 0, nexttarget = 0, nextnick = 262145, targets = "service\0\0\0\0spacetron",
  buffer = "ix.net", '\0' <repeats 50 times>, "°ú\035\b`Û\035\b", '\0' <repeats 12 times>, "\001\004", '\0' <repeats 18 times>, "\031\0\0\0spa
cetronix.net\0t\0\0\0¹\0\0\0hù\035\b(ü\035\b\0\0\0\0\200û\035\b\0\0\0\0!\220W?\200\020\005\0 \020\006\0Ø¿\035\b\0ÿÿÿ\001ChanGuard", '\0' <repe
ats 55 times>, "unknown\0\0\0\0Bot Service", '\0' <repeats 41 times>, "Ø¿\035\b\001\0\0\0\0\0\0\0\221", '\0' <repeats 23 times>, "\001\0\0\0se
rvice"..., lastsq = -256, sendQ = {length = 19457, offset = 0, head = 0x0, tail = 0x0}, recvQ = {length = 0, offset = 0, head = 0x0,
    tail = 0x0}, nospoof = 0, proto = 0, sendM = 0, sendK = 0, receiveM = 0, ssl = 0x0, lastrecvM = 0, priority = 0, receiveK = 1802401024,
  sendB = 28526, receiveB = 28279, listener = 0x0, class = 0x694e2d4c, authfd = 1159752547, slot = 26222, ip = {s_addr = 779248995},
  port = 20000, hostp = 0x65532d4c, watches = 30322, watch = 0x41207365,
  sockhost = "vailable.", '\0' <repeats 11 times>, "Ø¿\035\b\001\0\0\0\0\0\0\0\221", '\0' <repeats 23 times>, "\001\0\0\0serv",
  passwd = 0x656369 <Address 0x656369 out of bounds>, error_str = 0x73000000 <Address 0x73000000 out of bounds>}
(gdb) p *chptr
$2 = {nextch = 0x81e05c8, prevch = 0x0, hnextch = 0x0, mode = {mode = 36896, limit = 0, key = '\0' <repeats 23 times>,
    link = '\0' <repeats 32 times>, floodprot = 0x81e06e8}, creationtime = 1062703142,
  topic = 0x81e0728 "\00311,10[\0031]\0038,1\037¯\00313,6[\0031]\0038,1¯\00311,10[\0031]\0038,1¯\00313,6[\0031]\0038,1¯\00311,10[\0031]\037\00
39,6 Welcome To \002#SpaceTronix\002. This is the official \002SpaceTronix\002 Network Channel \00311,10[\0031]\0038,1\037¯\00313,6[\0031]\003
8,1¯\00311,10[\0031]\0038,1¯\0031"..., topic_nick = 0x81e0810 "[email protected]", topic_time = 1062187754,
  users = 2, members = 0x81e5db8, invites = 0x0, banlist = 0x0, exlist = 0x0, chname = "#"}
(gdb) p *chptr->mode.floodprot
$3 = {per = 10, t = {0, 0, 0, 0, 0, 0}, c = {0, 0, 0, 0, 0, 0}, l = {0, 0, 0, 0, 0, 15}, a = "\0\0\0\0\0b"}
(gdb)

2.
gdb) p *sptr
$1 = {next = 0x81dee10, prev = 0x81df0d0, hnext = 0x0, user = 0x81df028, serv = 0x0, lastnick = 1062691330, flags = 331904, umodes = 397344,
  from = 0x81dc568, fd = -256, hopcount = 1 '\001', name = "ChanBot", '\0' <repeats 56 times>, username = "unknown\0\0\0",
  info = "Bot Service", '\0' <repeats 39 times>, srvptr = 0x81dc568, status = 1, count = 0, oflag = 145, since = 136212776, firsttime = 0,
  lasttime = 0, last = 0, nexttarget = 0, nextnick = 65537, targets = "service\0\0\0\0spacetron",
  buffer = "ix.net", '\0' <repeats 50 times>, "¸Ã°\035\b\0Ñ\035\b", '\0' <repeats 12 times>, "\001\004", '\0' <repeats 18 times>, "\031\0\0\0sp
acetronix.net\0t\0\0\0¹\0\0\0pï\035\b0ò\035\b\0\0\0\0\210ñ\035\b\0\0\0\0\002bW?\200\020\005\0 \020\006\0hÅ\035\b\0ÿÿÿ\001ChanGuard", '\0' <rep
eats 55 times>, "unknown\0\0\0\0Bot Service", '\0' <repeats 41 times>, "hÃ…\035\b\001\0\0\0\0\0\0\0\221", '\0' <repeats 23 times>, "\001\0\0\0s
ervice"..., lastsq = -256, sendQ = {length = 19457, offset = 0, head = 0x0, tail = 0x0}, recvQ = {length = 0, offset = 0, head = 0x0,
    tail = 0x0}, nospoof = 0, proto = 0, sendM = 0, sendK = 0, receiveM = 0, ssl = 0x0, lastrecvM = 0, priority = 0, receiveK = 1802401024,
  sendB = 28526, receiveB = 28279, listener = 0x0, class = 0x694e2d4c, authfd = 1159752547, slot = 26222, ip = {s_addr = 779248995},
  port = 20000, hostp = 0x65532d4c, watches = 30322, watch = 0x41207365,
  sockhost = "vailable.", '\0' <repeats 11 times>, "hÃ…\035\b\001\0\0\0\0\0\0\0\221", '\0' <repeats 23 times>, "\001\0\0\0serv",
  passwd = 0x656369 <Address 0x656369 out of bounds>, error_str = 0x73000000 <Address 0x73000000 out of bounds>}
(gdb) p *chptr
$2 = {nextch = 0x0, prevch = 0x81dc3e8, hnextch = 0x0, mode = {mode = 4128, limit = 0, key = '\0' <repeats 23 times>,
    link = '\0' <repeats 32 times>, floodprot = 0x81dc3a8}, creationtime = 1062690433, topic = 0x0, topic_nick = 0x0, topic_time = 0,
  users = 2, members = 0x81e5bf8, invites = 0x0, banlist = 0x0, exlist = 0x0, chname = "#"}
(gdb) p *chptr->mode.floodprot
$3 = {per = 15, t = {0, 0, 0, 0, 0, 0}, c = {0, 0, 0, 0, 0, 0}, l = {0, 20, 0, 50, 7, 15}, a = "\0i\0mN"}
(gdb)

syzop

2003-09-04 19:36

administrator   ~0003578

Hmmm :|.
Could you send (of nr 1.) the core dump + src/ircd binary + src/channel.c (mine is already "too new") to [email protected] (or upload it somewhere).

Rocko

2003-09-04 19:50

reporter   ~0003579

Ok done.
I sent it to your mail address.

syzop

2003-09-04 20:05

administrator   ~0003580

Thanks.
I think I've fixed it (in .1898), can you verify that?

Rocko

2003-09-04 20:24

reporter   ~0003581

Yes, it's fixed.

I have tested other bug again (modes-on-join).
There is still one.

unrealircd.conf -> modes-on-join "ntf [20j#R,50m#M,7n,15t#b]:30";
server sets -> server.TEST.net sets mode: +ntf [20j#R,50m,7n,15t#b]:30

The rest is ok ;)

syzop

2003-09-04 20:33

administrator   ~0003582

Argh, that's the 3rd time I find a copy/paste error in that part of the code. Fixed in .1899.

Thanks a lot for testing it out / finding all of these bugs :).

Rocko

2003-09-04 20:40

reporter   ~0003583

hehe np ;)

All fixed now ;)

Issue History

Date Modified Username Field Change
2003-09-04 16:23 Rocko New Issue
2003-09-04 19:13 syzop Note Added: 0003574
2003-09-04 19:26 Rocko Note Added: 0003577
2003-09-04 19:36 syzop Note Added: 0003578
2003-09-04 19:50 Rocko Note Added: 0003579
2003-09-04 20:05 syzop Note Added: 0003580
2003-09-04 20:24 Rocko Note Added: 0003581
2003-09-04 20:33 syzop Note Added: 0003582
2003-09-04 20:40 Rocko Note Added: 0003583
2003-09-04 21:02 syzop Status new => resolved
2003-09-04 21:02 syzop Resolution open => fixed
2003-09-04 21:02 syzop Assigned To => syzop
2003-11-20 19:43 syzop Status resolved => closed