View Issue Details

IDProjectCategoryView StatusLast Update
0003076unrealircdpublic2006-11-04 11:21
ReporterPHANTOm Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status closedResolutionno change required 
Product Version3.2.5 
Summary0003076: TKL Crash
DescriptionI was working on a services featre and after sending the following line:
16:38:55 >> :services.nix.co.il TKL - G * testing.onion.test [email protected] 1159541881 1159536121 :Autokilled: Please visit http://www.irc.nix.co.il/akill/9 for more information
The services decided to go crash, here's the dbg
#0 ircvsprintf (
    str=0x8126183 " at Fri Sep 29 13:22:01 2006 - reason: Autokilled: Please visit http://www.irc.nix.co.il/akill/9 for more information)\r\n",
    format=0xb7b81f28 <Address 0xb7b81f28 out of bounds>, vl=0xbf9efa0c "")
    at ircsprintf.c:289
289 if ((*str = *p1))
3rd party modules

Activities

stskeeps

2006-09-29 11:50

reporter   ~0012462

Could you please do a full 'bt' in it?
./unreal backtrace

PHANTOm

2006-09-30 11:46

reporter   ~0012465

BACKTRACE:
Using host libthread_db library "/lib/libthread_db.so.1".
Core was generated by `/home/nixircd/UnrealIRCd3.2.5/src/ircd'.
Program terminated with signal 11, Segmentation fault.

warning: Can't read pathname for load map: Input/output error.
#0 ircvsprintf (
    str=0x8126183 " at Fri Sep 29 13:22:01 2006 - reason: Autokilled: Please visit http://www.irc.nix.co.il/akill/9 for more information)\r\n",
    format=0xb7b81f28 "", vl=0xbf9efa0c "") at ircsprintf.c:289
289 if ((*str = *p1))
#0 ircvsprintf (
    str=0x8126183 " at Fri Sep 29 13:22:01 2006 - reason: Autokilled: Please visit http://www.irc.nix.co.il/akill/9 for more information)\r\n",
    format=0xb7b81f28 "", vl=0xbf9efa0c "") at ircsprintf.c:289
#1 0x08087974 in vsendto_one (to=0x81b4948, pattern=0xbf9efa08 "",
    vl=0xbf9efa08 "") at send.c:243
#2 0x0808825b in sendto_serv_butone (one=0x83b9cc8,
    pattern=0xb7b81f08 ":%s TKL %s %s %s %s %s %s %s :%s") at send.c:673
#3 0xb7b52b49 in _m_tkl (cptr=0x83b9cc8, sptr=0x83b9cc8, parc=9,
    parv=0x811f4e0) at m_tkl.c:2226
#4 0x08067993 in parse (cptr=0x83b9cc8,
    buffer=0x83b9dac ":services.nix.co.il TKL", bufend=0xbf9efa08 "")
    at parse.c:440
#5 0x08066786 in dopacket (cptr=0x83b9cc8,
    buffer=0x80b24a0 ":services.nix.co.il TKL - G * testing.onion.test [email protected] 1159541881 1159536121 :Autokilled: Please visit http://www.irc.nix.co.il/akill/9 for more information\r\nk80oQDA1I\r\nWHO }vd9q4"...,
    length=1) at packet.c:138
#6 0x08058548 in read_message (delay=1, listp=0x8162740) at s_bsd.c:1475
#7 0x080628a4 in main (argc=0, argv=0xbf9f07d4) at ircd.c:1580

#0 ircvsprintf (
    str=0x8126183 " at Fri Sep 29 13:22:01 2006 - reason: Autokilled: Please visit http://www.irc.nix.co.il/akill/9 for more information)\r\n",
    format=0xb7b81f28 "", vl=0xbf9efa0c "") at ircsprintf.c:289
289 if ((*str = *p1))

0x8167540 <backupbuf>: ":services.nix.co.il TKL - G * testing.onion.test [email protected] 1159541881 1159536121 :Autokilled: Please visit http://www.irc.nix.co.il/akill/9 for more information"

#0 ircvsprintf (
    str=0x8126183 " at Fri Sep 29 13:22:01 2006 - reason: Autokilled: Please visit http://www.irc.nix.co.il/akill/9 for more information)\r\n",
    format=0xb7b81f28 "", vl=0xbf9efa0c "") at ircsprintf.c:289
        p1 = 0x0
        c = 8 '\b'
#1 0x08087974 in vsendto_one (to=0x81b4948, pattern=0xbf9efa08 "",
    vl=0xbf9efa08 "") at send.c:243

No locals.
#2 0x0808825b in sendto_serv_butone (one=0x83b9cc8,
    pattern=0xb7b81f08 ":%s TKL %s %s %s %s %s %s %s :%s") at send.c:673
        i = -1080100344
        cptr = (aClient *) 0xbf9efa08
        j = 1
GCC: gcc version 3.4.6 (Gentoo 3.4.6-r1, ssp-3.4.5-1.0, pie-8.7.9)
UNAME: Linux echo 2.6.17-gentoo-r7-PHANTOm #1 SMP Fri Sep 8 23:26:47 IDT 2006 i686 Intel(R) Pentium(R) 4 CPU 3.00GHz GNU/Linux
UNREAL: Unreal3.2.5 build 1.1.1.1.2.23 2006/06/16 18:29:12
CORE: -rw------- 1 nixircd nix 32567296 Sep 29 16:39 core

syzop

2006-11-04 11:21

administrator   ~0012576

Sorry for taking so long, just noticed this issue now, and now I looked it's easy :P.

It seems this crash occurs because your services are sending a TKL message (gline removal request) with incorrect syntax. It's possible that in older versions it did not crash, simply due to "luck in the code".

It sent:
:services.nix.co.il TKL - G * testing.onion.test [email protected] 1159541881 1159536121 :Autokilled: Please visit blablabla
And it should have sent:
:services.nix.co.il TKL - G * testing.onion.test [email protected]

See also http://www.vulnscan.org/UnrealIRCd/serverprotocol.html#S8_1 for more info on TKL syntax. But in short: the last 3 parameters should be omitted when REMOVING a *line.

Perhaps you already figured that out, but if not, hope this helps.

Issue History

Date Modified Username Field Change
2006-09-29 09:29 PHANTOm New Issue
2006-09-29 11:50 stskeeps Note Added: 0012462
2006-09-30 11:46 PHANTOm Note Added: 0012465
2006-11-04 11:21 syzop Status new => closed
2006-11-04 11:21 syzop Note Added: 0012576
2006-11-04 11:21 syzop Resolution open => no change required