eggheads / eggdrop

The Eggdrop IRC Bot
GNU General Public License v2.0
509 stars 84 forks source link

SIGILL -> endless loop #1640

Open michaelortmann opened 4 months ago

michaelortmann commented 4 months ago

eggdrop can run into an endless loop in its ill signal handler.

for a minimal demo, i introduced a malicious division by zero into eggdrops source dcc.c:dcc_remove_lost():for (i = 1 / 0; i < dcc_total; i++) {, compiled and run it. result:

[04:12:53] triggering bind quotepong_servermsg
[04:12:53] triggered bind quotepong_servermsg, user 0.004ms sys 0.000ms
[04:12:53] -NOTICE- *** Found your hostname: localhost
[04:12:53] * Please REPORT this BUG!
[04:12:53] * Check doc/BUG-REPORT on how to do so.
[04:12:53] * Last bind (may not be related): quotepong_servermsg
[04:12:53] * Please REPORT this BUG!
[04:12:53] * Check doc/BUG-REPORT on how to do so.
[04:12:53] * Last bind (may not be related): quotepong_servermsg
[04:12:53] * Please REPORT this BUG!
[04:12:53] * Check doc/BUG-REPORT on how to do so.
[04:12:53] * Last bind (may not be related): quotepong_servermsg
[...]

Default action for SIGILL is core dump / stack trace. Our current signal handler tries to ignore the signal. Effect is, we can no longer debug SIGILL, no stack trace, to useful information about the cause or even what happened is printed.