paolostivanin / OTPClient

Highly secure and easy to use OTP client written in C/GTK3 that supports both TOTP and HOTP
GNU General Public License v3.0
472 stars 46 forks source link

failure when configured db file path is a symlink #289

Closed ph1l closed 1 year ago

ph1l commented 1 year ago

On a Pinephone Pro, running Mobian:

Mar 14 16:40:31 mobian PackageKit[2669]: in /203_dabbecdb for install-packages package otpclient;3.1.4-1;arm64;+manual:debian-testing-main was installing for uid 1000
Mar 14 16:58:46 mobian otpclient[3168]: ../../../glib/gmem.c:169: failed to allocate 18446744073709551588 bytes
mobian@mobian:~$ otpclient-cli list
Type the DB decryption password: 

(process:4169): GLib-ERROR **: 17:25:48.393: ../../../glib/gmem.c:169: failed to allocate 18446744073709551575 bytes
Trace/breakpoint trap
paolostivanin commented 1 year ago

Hello, this seems like a secure memory issue. It seems that it can't allocate enough secure memory to run the program. See if this help!

ph1l commented 1 year ago

Seems like the system already has a setting over what's in your doc (16384):

mobian@mobian:~$ ulimit -l
495332

but I increased it by a factor of 4, and the same error sems to occur:

mobian@mobian:~$ sudo cat /etc/security/limits.d/memlock.conf
* soft memlock 1981328
* hard memlock 1981328
mobian@mobian:~$ sudo shutdown -r now
mobian@mobian:~$ ulimit -l
1981328
mobian@mobian:~$ otpclient-cli list
Type the DB decryption password: 

(process:1970): GLib-ERROR **: 19:00:28.707: ../../../glib/gmem.c:169: failed to allocate 18446744073709551575 bytes
Trace/breakpoint trap

Thanks for your quick response, Let me know what else I can try!

paolostivanin commented 1 year ago

This is gonna be hard to debug, because I don't have access to any arm device of my own. If I provide you with some code that you have to compile and execute (from the terminal), would you be comfortable with that?

paolostivanin commented 1 year ago

Also, has it ever worked there or is it the first time you try otpclient on such device?

paolostivanin commented 1 year ago

Please compile the program from the following branch and then execute it from the terminal and paste the output here. Thanks!

ph1l commented 1 year ago

This is gonna be hard to debug, because I don't have access to any arm device of my own. If I provide you with some code that you have to compile and execute (from the terminal), would you be comfortable with that?

No problem

Also, has it ever worked there or is it the first time you try otpclient on such device?

Well, lets see.. I think i ran the flatpak successfully a few months back on a librem5 running pureOS (a debian fork.) which is also an arm device.

ph1l commented 1 year ago

Please compile the program from the following branch and then execute it from the terminal and paste the output here. Thanks!

getting the build environment all setup here will take me a bit, but i'll try to get this done tonight. Thanks!

ph1l commented 1 year ago
mobian@mobian:~/code/OTPClient/build$ cmake -DCMAKE_BUILD_TYPE=Debug ..
mobian@mobian:~/code/OTPClient/build$ gdb ./otpclient-cli
GNU gdb (Debian 13.1-2) 13.1
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./otpclient-cli...
(gdb) set args list
(gdb) run
Starting program: /home/mobian/code/OTPClient/build/otpclient-cli list
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
Type the DB decryption password: 
=> before loadb
=> before decrypt
[New Thread 0xfffff524ee20 (LWP 6966)]
[New Thread 0xfffff4a3ee20 (LWP 6967)]

(process:6964): GLib-ERROR **: 21:18:52.257: ../../../glib/gmem.c:169: failed to allocate 18446744073709551575 bytes

Thread 1 "otpclient-cli" received signal SIGTRAP, Trace/breakpoint trap.
__pthread_kill_implementation (threadid=281474840700704, signo=signo@entry=5, no_tid=no_tid@entry=0)
    at ./nptl/pthread_kill.c:44
44      ./nptl/pthread_kill.c: No such file or directory.
(gdb) bt
#0  __pthread_kill_implementation (threadid=281474840700704, signo=signo@entry=5, no_tid=no_tid@entry=0)
    at ./nptl/pthread_kill.c:44
#1  0x0000fffff6fa09e4 in __pthread_kill_internal (signo=5, threadid=<optimized out>)
    at ./nptl/pthread_kill.c:78
#2  0x0000fffff6f5a76c in __GI_raise (sig=5) at ../sysdeps/posix/raise.c:26
#3  0x0000fffff7eaeaf4 in g_log_default_handler () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#4  0x0000fffff7eaed60 in g_logv () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#5  0x0000fffff7eaefac in g_log () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#6  0x0000fffff7ead52c in g_malloc0 () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#7  0x0000aaaaaaaa8cd0 in decrypt_db (password=0xfffff5310008 "PASSWD", db_path=<optimized out>)
    at /home/mobian/code/OTPClient/src/db-misc.c:334
#8  load_db (db_data=0xaaaaaaadfbe0, err=0xfffffffff0c0) at /home/mobian/code/OTPClient/src/db-misc.c:49
#9  0x0000aaaaaaaa655c in main (argc=2, argv=0xfffffffff248) at /home/mobian/code/OTPClient/src/cli/main.c:83
(gdb) 
ph1l commented 1 year ago

gsize enc_buf_size = input_file_size - sizeof (HeaderData) - TAG_SIZE;

(gdb) print input_file_size

$4 = 23 (gdb) print sizeof (HeaderData)

$5 = 48 (gdb) print enc_buf_size

$3 = 18446744073709551575

ph1l commented 1 year ago

oh, I see...

I'm using a symlink from the database location, but the get_file_size function is returning the size of the symlink not the size of the database file that it points to. Hence the "underflow" in enc_buf_size.

ph1l commented 1 year ago

Everything works if i replace the symlink with the actual file.

paolostivanin commented 1 year ago

nice investigation, and thanks a lot for the fix :smile: