View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001617 | unreal | ircd | public | 2004-03-03 21:30 | 2004-03-04 17:30 |
| Reporter | Z3l3zT | Assigned To | |||
| Priority | normal | Severity | crash | Reproducibility | always |
| Status | closed | Resolution | open | ||
| Product Version | 3.2-RC1 | ||||
| Summary | 0001617: IRCd crash when operstats tries to link. | ||||
| Description | When I try to link operstats (http://www.habber.net/services), unrealircd crashes.. The network currently look like this, [operstats]--[hub1]--[hub2] .. both hubs crashes for some reason.. | ||||
| Steps To Reproduce | Simply start it and link it to a hub. (normal "serversonly;" link. | ||||
| Additional Information | [ircd@omikron:~/Unreal3.2]$ gdb src/ircd ircd.core GNU gdb 5.2.1 (FreeBSD) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... Core was generated by `ircd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/libssl.so.3...done. Loaded symbols for /usr/lib/libssl.so.3 Reading symbols from /lib/libcrypto.so.3...done. Loaded symbols for /lib/libcrypto.so.3 Reading symbols from /lib/libcrypt.so.2...done. Loaded symbols for /lib/libcrypt.so.2 Reading symbols from /lib/libz.so.2...done. Loaded symbols for /lib/libz.so.2 Reading symbols from /lib/libc.so.5...done. Loaded symbols for /lib/libc.so.5 Reading symbols from tmp/8C874921.commands.so...done. Loaded symbols for tmp/8C874921.commands.so Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 ircvsprintf (str=0x8134ceb "ents)\r\n", format=0xbfbfe3a3 "@%s)", vl=0xbfbfe794 "#") at ircsprintf.c:289 289 if ((*str = *p1)) | ||||
| 3rd party modules | |||||
| related to | 0003059 | closed | UnrealIRCd crashed when a server issues the /stats-cmd |
|
|
Could you type 'bt' in gdb? ;). |
|
|
If I recall, it's because OperStats incorrectly assumes it is ok for a server to make a /stats request when in fact nothing in RFC1459 says this is the case, in fact it says this is illegal because it says a numeric reply should never be sent to a server. Therefore, if it is the /stats problem, the problem lies in OperStats, not Unreal. |
|
|
-- (gdb) bt #0 ircvsprintf (str=0x8134ceb "ents)\r\n", format=0xbfbfe3a3 "@%s)", vl=0xbfbfe794 "#") at ircsprintf.c:289 #1 0x08091852 in vsendto_one (to=0x81b3800, pattern=0xbfbfe360 ":aurora.se.eu.rc0.net NOTICE Z3l3zT :Stats '%c' requested by %s (%s@%s)", vl=0xbfbfe788 "u") at send.c:243 #2 0x08092f46 in sendto_snomask (snomask=64, pattern=0x80b7220 "Stats '%c' requested by %s (%s@%s)") at send.c:1462 #3 0x08095da6 in m_stats (cptr=0x18, sptr=0x81b3c00, parc=3, parv=0x812baa0) at s_stats.c:411 #4 0x0806cff5 in parse (cptr=0x81b3c00, buffer=0x81b3ce4 ":stats.rc0.net 2", bufend=0x81b3d0b "") at parse.c:453 #5 0x0806bc51 in dopacket (cptr=0x81b3c00, buffer=0x812c460 "NICK Global 1 1078363600 service rc0.net stats.rc0.net 1 +ioS * :Global Noticer\r\n\nNICK Guest84018 1 1078363600 ~frodo dialup-019-c34.rgnet.org stats.rc0.net 1 + * :neo\r\n\n:stats.rc0.net + aurora.se.eu."..., length=56) at packet.c:138 #6 0x08072385 in read_packet (cptr=0x81b3c00, rfd=0xbfbfe790) at s_bsd.c:1447 #7 0x08072c2f in read_message (delay=2, listp=0x8169da0) at s_bsd.c:1937 0000008 0x08068c93 in main (argc=0, argv=0x815bb20) at ircd.c:1450 #9 0x08053852 in _start () -- Heh, sorry, I barley know how gdb works :) however, even if the bug is in OperStats, aint it a security problem in Unreal too? Since a simple command from the OperStats server can crash the IRCd.. an error is good enough instead of a crash? ;) |
|
|
that's all we needed. This is indeed an operstats bug as codemastr says... unfortunately it looks like last operstats version was released in April 2003 so... ;). Anyway, you should complain to them, it's probably a pretty easy fix :P. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2004-03-03 21:30 | Z3l3zT | New Issue | |
| 2004-03-03 21:33 | syzop | Note Added: 0005290 | |
| 2004-03-03 23:00 |
|
Note Added: 0005291 | |
| 2004-03-04 17:04 | Z3l3zT | Note Added: 0005295 | |
| 2004-03-04 17:30 | syzop | Status | new => closed |
| 2004-03-04 17:30 | syzop | Note Added: 0005296 | |
| 2006-09-09 04:47 |
|
Relationship added | related to 0003059 |
