search

eggheads / eggdrop

The Eggdrop IRC Bot
GNU General Public License v2.0
501 stars 84 forks source link

Buffer overflow bug in uptime module (was eggdrop dies before reaching 4 hours 7 minutes uptime) #377

Open wakco opened 7 years ago

wakco commented 7 years ago

Running eggdrop v1.8.1, on Darwin 16.5.0 (macOS 10.12.4). Only working make options are make static and make sdebug, yet neither are logging anything to explain while the eggdrop just dies. I added a bind for every minute to login the uptime, and the highest time recorded is 4 hours 6 minutes and 25 seconds. The signoff from irc is reporting EOF from client. I added binds to catch and attempt to log any signals it might be receiving, and still nothing is logged. The only log entry I can find that if from the time it dies are:

Apr 22 06:56:06 halo eggdrop[7152]: no path for address 0x105491000

Obviously the date/time, the process id, and the address changes, but there is one of these lines for every time the eggdrop bot just dies. Any help would be appreciated.

wakco commented 7 years ago

Being macOS, turns out there are crash logs to look at as well...

Process:               eggdrop-1.8.1 [7152]
Path:                  /Users/*/eggdrop-1.8.1
Identifier:            eggdrop-1.8.1
Version:               ???
Code Type:             X86-64 (Native)
Parent Process:        launchd [1]
Responsible:           eggdrop-1.8.1 [7152]
User ID:               1030

Date/Time:             2017-04-22 06:56:06.470 +1200
OS Version:            Mac OS X 10.12.4 (16E195)
Report Version:        12
Anonymous UUID:        1358BC35-DCF7-10CF-FDBE-B938E8DEEA27

Time Awake Since Boot: 2100000 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_CRASH (SIGABRT)
Exception Codes:       0x0000000000000000, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Application Specific Information:
*** multi-threaded process forked ***
detected buffer overflow

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib          0x00007fffa6d7cd42 __pthread_kill + 10
1   libsystem_pthread.dylib         0x00007fffa6e6a5bf pthread_kill + 90
2   libsystem_c.dylib               0x00007fffa6ce2420 abort + 129
3   libsystem_c.dylib               0x00007fffa6ce2592 abort_report_np + 181
4   libsystem_c.dylib               0x00007fffa6d08f28 __chk_fail + 48
5   libsystem_c.dylib               0x00007fffa6d08ef8 __chk_fail_overflow + 16
6   libsystem_c.dylib               0x00007fffa6d09413 __sprintf_chk + 199
7   eggdrop                         0x0000000102390870 send_uptime + 576 (uptime.c:223)
8   eggdrop                         0x00000001023909b9 check_secondly + 57 (uptime.c:251)
9   eggdrop                         0x00000001022fdfc8 mainloop + 104 (.main.c:780)
10  eggdrop                         0x00000001022ff29a main + 2890 (.main.c:1220)
11  libdyld.dylib                   0x00007fffa6c4e235 start + 1

Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x0000000000000000  rbx: 0x0000000000000006  rcx: 0x00007fff5d9272e8  rdx: 0x0000000000000000
  rdi: 0x0000000000000203  rsi: 0x0000000000000006  rbp: 0x00007fff5d927310  rsp: 0x00007fff5d9272e8
   r8: 0x0000000000000000   r9: 0x0000000c7ffc7ff5  r10: 0x0000000008000000  r11: 0x0000000000000206
  r12: 0x0000000102d81f40  r13: 0x00007fb8f67057c0  r14: 0x00007fffafbcd3c0  r15: 0x00000001023f6380
  rip: 0x00007fffa6d7cd42  rfl: 0x0000000000000206  cr2: 0x00007fffa6e6838f

Logical CPU:     0
Error Code:      0x02000148
Trap Number:     133

Binary Images:
       0x1022d8000 -        0x1023a8ffb +eggdrop (0) <1C078A31-7639-3B42-90C3-611C343932ED> /Users/*/eggdrop
       0x102dbe000 -        0x102e8affb  Tcl (8.5.9 - 8.5.9) <6E1BDB80-428A-318C-8CEF-17374E3B8084> /System/Library/Frameworks/Tcl.framework/Versions/8.5/Tcl
       0x105491000 -        0x1054cedc7  dyld (433.5) <8239D0D7-66F6-3C44-A77F-586F74525DA3> /usr/lib/dyld
    0x7fff90eb3000 -     0x7fff91346fff  com.apple.CoreFoundation (6.9 - 1349.65) <2B7C4BA4-D69E-3651-93DF-3930880B5084> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
    0x7fffa53f2000 -     0x7fffa53f3ff3  libDiagnosticMessagesClient.dylib (102) <84A04D24-0E60-3810-A8C0-90A65E2DF61A> /usr/lib/libDiagnosticMessagesClient.dylib
    0x7fffa5631000 -     0x7fffa5632ffb  libSystem.B.dylib (1238.51.1) <D9B20A4F-87BC-36CB-9405-80E105666725> /usr/lib/libSystem.B.dylib
    0x7fffa57e4000 -     0x7fffa583aff7  libc++.1.dylib (307.5) <0B43BB5D-E6EB-3464-8DE9-B41AC8ED9D1C> /usr/lib/libc++.1.dylib
    0x7fffa583b000 -     0x7fffa5865fff  libc++abi.dylib (307.3) <30199352-88BF-30BD-8CFF-2A4FBE247523> /usr/lib/libc++abi.dylib
    0x7fffa5da4000 -     0x7fffa5fc9ffb  libicucore.A.dylib (57163.0.1) <325E1C97-1C45-3A7E-9AFB-D1328E31D879> /usr/lib/libicucore.A.dylib
    0x7fffa6358000 -     0x7fffa672dbc7  libobjc.A.dylib (709) <54CD8D1A-5C98-3559-B13A-932B3D3DD338> /usr/lib/libobjc.A.dylib
    0x7fffa6783000 -     0x7fffa679fffb  libresolv.9.dylib (64) <A244AE4C-00B0-396C-98FF-97FE4DB3DA30> /usr/lib/libresolv.9.dylib
    0x7fffa6b52000 -     0x7fffa6b63ff3  libz.1.dylib (67) <46E3FFA2-4328-327A-8D34-A03E20BFFB8E> /usr/lib/libz.1.dylib
    0x7fffa6b72000 -     0x7fffa6b76ff7  libcache.dylib (79) <093A4DAB-8385-3D47-A350-E20CB7CCF7BF> /usr/lib/system/libcache.dylib
    0x7fffa6b77000 -     0x7fffa6b81fff  libcommonCrypto.dylib (60092.50.5) <BE8380C5-C09D-3F48-A502-AEBB58231067> /usr/lib/system/libcommonCrypto.dylib
    0x7fffa6b82000 -     0x7fffa6b89fff  libcompiler_rt.dylib (62) <55D47421-772A-32AB-B529-1A46C2F43B4D> /usr/lib/system/libcompiler_rt.dylib
    0x7fffa6b8a000 -     0x7fffa6b92fff  libcopyfile.dylib (138) <819BEA3C-DF11-3E3D-A1A1-5A51C5BF1961> /usr/lib/system/libcopyfile.dylib
    0x7fffa6b93000 -     0x7fffa6c16fdf  libcorecrypto.dylib (442.50.19) <8A39EE06-121C-3731-A9E9-35847064B3EE> /usr/lib/system/libcorecrypto.dylib
    0x7fffa6c17000 -     0x7fffa6c48fff  libdispatch.dylib (703.50.37) <D122E712-9593-31CA-BAC4-4A54410BF4A0> /usr/lib/system/libdispatch.dylib
    0x7fffa6c49000 -     0x7fffa6c4effb  libdyld.dylib (433.5) <129D3B44-FB21-3750-9A68-48B5C3DC632B> /usr/lib/system/libdyld.dylib
    0x7fffa6c4f000 -     0x7fffa6c4fffb  libkeymgr.dylib (28) <7AA011A9-DC21-3488-BF73-3B5B14D1FDD6> /usr/lib/system/libkeymgr.dylib
    0x7fffa6c5d000 -     0x7fffa6c5dfff  liblaunch.dylib (972.50.27) <037D198D-9B02-3EF9-A8E9-6F43EA555A9E> /usr/lib/system/liblaunch.dylib
    0x7fffa6c5e000 -     0x7fffa6c63ff3  libmacho.dylib (898) <17D5D855-F6C3-3B04-B680-E9BF02EF8AED> /usr/lib/system/libmacho.dylib
    0x7fffa6c64000 -     0x7fffa6c66ff3  libquarantine.dylib (85.50.1) <7B32EA91-AB8B-32A4-8E52-9D3ED46CAC8E> /usr/lib/system/libquarantine.dylib
    0x7fffa6c67000 -     0x7fffa6c68ffb  libremovefile.dylib (45) <38D4CB9C-10CD-30D3-8B7B-A515EC75FE85> /usr/lib/system/libremovefile.dylib
    0x7fffa6c69000 -     0x7fffa6c81ff7  libsystem_asl.dylib (349.50.5) <096E4228-3B7C-30A6-8B13-EC909A64499A> /usr/lib/system/libsystem_asl.dylib
    0x7fffa6c82000 -     0x7fffa6c82ff7  libsystem_blocks.dylib (67) <10DC5404-73AB-35B3-A277-A8AFECB476EB> /usr/lib/system/libsystem_blocks.dylib
    0x7fffa6c83000 -     0x7fffa6d10fef  libsystem_c.dylib (1158.50.2) <B03F8915-1E9B-3C84-AED5-68E2E0031630> /usr/lib/system/libsystem_c.dylib
    0x7fffa6d11000 -     0x7fffa6d14ffb  libsystem_configuration.dylib (888.51.2) <872C8A42-0871-3424-830B-84E587A75D27> /usr/lib/system/libsystem_configuration.dylib
    0x7fffa6d15000 -     0x7fffa6d18fff  libsystem_coreservices.dylib (41.4) <FD0915E8-9C43-3FCB-94E0-33C45DF028CD> /usr/lib/system/libsystem_coreservices.dylib
    0x7fffa6d19000 -     0x7fffa6d31fff  libsystem_coretls.dylib (121.50.4) <EC6FCF07-DCFB-3A03-9CC9-6DD3709974C6> /usr/lib/system/libsystem_coretls.dylib
    0x7fffa6d32000 -     0x7fffa6d38fff  libsystem_dnssd.dylib (765.50.9) <FF02A197-7CEF-3684-8155-E5E225051E44> /usr/lib/system/libsystem_dnssd.dylib
    0x7fffa6d39000 -     0x7fffa6d62ff7  libsystem_info.dylib (503.50.4) <611DB84C-BF70-3F92-8702-B9F28A900920> /usr/lib/system/libsystem_info.dylib
    0x7fffa6d63000 -     0x7fffa6d85ff7  libsystem_kernel.dylib (3789.51.2) <FC51D7B0-8292-3F6A-9231-64340B237EB7> /usr/lib/system/libsystem_kernel.dylib
    0x7fffa6d86000 -     0x7fffa6dcdfe7  libsystem_m.dylib (3121.6) <A790C9A5-DD24-32F5-8FD7-33BFCE79AC87> /usr/lib/system/libsystem_m.dylib
    0x7fffa6dce000 -     0x7fffa6decff7  libsystem_malloc.dylib (116.50.8) <48D1BBA3-914E-3C65-AF70-C33B4A1B5233> /usr/lib/system/libsystem_malloc.dylib
    0x7fffa6ded000 -     0x7fffa6e46ffb  libsystem_network.dylib (856.50.56) <FDE14243-4328-3EFD-824C-C0D314D7B540> /usr/lib/system/libsystem_network.dylib
    0x7fffa6e47000 -     0x7fffa6e50ff3  libsystem_networkextension.dylib (563.50.32) <D5381DA9-529C-3588-BE16-A2245DE93423> /usr/lib/system/libsystem_networkextension.dylib
    0x7fffa6e51000 -     0x7fffa6e5aff3  libsystem_notify.dylib (165.20.1) <B8160190-A069-3B3A-BDF6-2AA408221FAE> /usr/lib/system/libsystem_notify.dylib
    0x7fffa6e5b000 -     0x7fffa6e63fe7  libsystem_platform.dylib (126.50.8) <5940EAB7-84D6-34DC-9B38-111648B2B589> /usr/lib/system/libsystem_platform.dylib
    0x7fffa6e64000 -     0x7fffa6e6eff7  libsystem_pthread.dylib (218.51.1) <62A84A68-431D-3B54-A7B6-31367CCF2884> /usr/lib/system/libsystem_pthread.dylib
    0x7fffa6e6f000 -     0x7fffa6e72ff7  libsystem_sandbox.dylib (592.50.47) <87A2327D-B7A1-3E4C-A85D-D3D9484003DB> /usr/lib/system/libsystem_sandbox.dylib
    0x7fffa6e73000 -     0x7fffa6e74ff3  libsystem_secinit.dylib (24.50.4) <F78B847B-3565-3E4B-98A6-F7AD40392E2D> /usr/lib/system/libsystem_secinit.dylib
    0x7fffa6e75000 -     0x7fffa6e7cffb  libsystem_symptoms.dylib (532.50.47) <9CF6A47C-8343-3E85-9C27-A8D98E726A8B> /usr/lib/system/libsystem_symptoms.dylib
    0x7fffa6e7d000 -     0x7fffa6e90ff7  libsystem_trace.dylib (518.51.1) <E1D540D8-CC88-3901-92BA-FC4B802FE0E8> /usr/lib/system/libsystem_trace.dylib
    0x7fffa6e91000 -     0x7fffa6e96ffb  libunwind.dylib (35.3) <3D50D8A8-C460-334D-A519-2DA841102C6B> /usr/lib/system/libunwind.dylib
    0x7fffa6e97000 -     0x7fffa6ec0ff7  libxpc.dylib (972.50.27) <ABC45890-DA23-3A4A-B50B-1384BD4CBBDF> /usr/lib/system/libxpc.dylib

External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 24
    thread_create: 0
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 1682350
    thread_create: 0
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=131.2M resident=0K(0%) swapped_out_or_unallocated=131.2M(100%)
Writable regions: Total=63.8M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=63.8M(100%)

                                VIRTUAL   REGION 
REGION TYPE                        SIZE    COUNT (non-coalesced) 
===========                     =======  ======= 
Activity Tracing                   256K        2 
Dispatch continuations            8192K        2 
Kernel Alloc Once                    8K        2 
MALLOC                            36.2M        8 
MALLOC guard page                   16K        4 
STACK GUARD                       56.0M        2 
Stack                             9752K        5 
Stack Guard                         12K        4 
VM_ALLOCATE                          4K        2 
__DATA                            12.7M       50 
__LINKEDIT                       114.8M        5 
__TEXT                            16.4M       47 
__UNICODE                          556K        2 
mapped file                       24.7M        2 
shared memory                       28K        5 
===========                     =======  ======= 
TOTAL                            279.2M      127
thommey commented 7 years ago

Hey there. Given that I see "send_uptime" in the stack trace, could you try disabling uptime.mod (not loading it in the config) and see if it stays up longer then? Thanks!

wakco commented 7 years ago

Sure done, will report back in 5 hours if it is still up. (And dang that felt like an obvious thing to try, wish I had thought of it).

wakco commented 7 years ago

Yes, that did it, so clearly there is an overflow bug in the uptime module. Thanks, I'll leave this open and rename it.

thommey commented 7 years ago

Thanks for reporting and testing this! I am fairly sure now that it is caused by our usage of http://c-faq.com/struct/structhack.html to allocate the udp packet. There is no accounting for padding or alignment either.