Segfault with RS-INTEROUTE

snar / bgpq3

bgpq3

BSD 2-Clause "Simplified" License

362 stars 53 forks source link

Segfault with RS-INTEROUTE #38

Closed devicenull closed 5 years ago

devicenull commented 6 years ago

bgpq3 -j -4 RS-INTEROUTE

gdb suggests the issue is around here

Program received signal SIGSEGV, Segmentation fault.
0x000000000040644f in bgpq_expand_irrd (b=0x7ffffff7e170,
    callback=0x404c7c , udata=0x0, fmt=0x410b37 "!i%s,1\n")
    at bgpq_expander.c:645
645                             memcpy(recvbuffer, eon+1, off - ((eon+1)-response));

devicenull commented 6 years ago

FWIW, the response here ends up being 'A23697440', so it seems to just be allocating too much memory?

snar commented 6 years ago

On Fri, Jun 01, 2018 at 01:49:32PM -0700, devicenull wrote:

bgpq3 -j -4 RS-INTEROUTE

Unable to reproduce :( FreeBSD 10-stable, bgpq3 just build from HEAD.

gdb suggests the issue is around here

Sorry for confusion: backtrace was not included into email, only seen in web version. Issue is indeed was with on-stack allocation, this is changed to classis malloc(3) with proper error checking.

Fixed version uploaded to HEAD, please check.

devicenull commented 6 years ago

Thanks, I can confirm this works properly with HEAD now.

job commented 5 years ago

@devicenull close this issue then! :)