solanum-ircd / solanum

An IRCd for unified networks
https://solanum.chat/
GNU General Public License v2.0
216 stars 53 forks source link

null dereference in configure_authd #396

Closed progval closed 1 year ago

progval commented 1 year ago

Happens since fbc97166a6e455f5cccf173abca3b9baedee4066 (cc @aaronmdjones):

$ cat /tmp/conf.txt
serverinfo {
    name = "My.Little.Server";
    sid = "42X";
    description = "test server";

};

general {
    throttle_count = 100;  # We need to connect lots of clients quickly
    # disable throttling for LIST and similar:
    pace_wait_simple = 0 second;
    pace_wait = 0 second;
    sasl_service = "SaslServ";
};

class "server" {
    ping_time = 5 minutes;
    connectfreq = 5 minutes;
};

listen {
    defer_accept = yes;

    host = "0.0.0.0";
    port = 33699;
    port = 57313;
};

auth {
    user = "*";
    flags = exceed_limit;

};

channel {
    disable_local_channels = no;
    no_create_on_split = no;
    no_join_on_split = no;
    displayed_usercount = 0;
};

connect "services.example.org" {
    host = "localhost";  # Used to validate incoming connection
    port = 0;  # We don't need servers to connect to services
    send_password = "password";
    accept_password = "password";
    class = "server";
    flags = topicburst;
};
service {
    name = "services.example.org";
};

privset "omnioper" {
    privs = oper:general, oper:privs, oper:testline, oper:kill, oper:operwall, oper:message,
            oper:routing, oper:kline, oper:unkline, oper:xline,
            oper:resv, oper:cmodes, oper:mass_notice, oper:wallops,
            oper:remoteban,
            usermode:servnotice, auspex:oper, auspex:hostname, auspex:umodes, auspex:cmodes,
            oper:admin, oper:die, oper:rehash, oper:spy, oper:grant;
};
operator "operuser" {
    user = "*@*";
    password = "operpassword";
    privset = "omnioper";
    flags = ~encrypted;
};

$ valgrind solanum -foreground -configfile /tmp/conf.txt
==3377160== Memcheck, a memory error detector
==3377160== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==3377160== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
==3377160== Command: solanum -foreground -configfile /tmp/conf.txt
==3377160== 
  notice: starting solanum-1.0-dev ...
  notice: librb version: 20210804-0fd3040c - OpenSSL: compiled 0x101010ef, library OpenSSL 1.1.1n  15 Mar 2022
==3377160== Invalid read of size 8
==3377160==    at 0x4B15250: rb_dictionary_foreach_start (dictionary.c:561)
==3377160==    by 0x485D4F3: configure_authd (authproc.c:355)
==3377160==    by 0x486D2C0: solanum_main (ircd.c:737)
==3377160==    by 0x4940D09: (below main) (libc-start.c:308)
==3377160==  Address 0x10 is not stack'd, malloc'd or (recently) free'd
==3377160== 
==3377160== 
==3377160== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==3377160==  Access not within mapped region at address 0x10
==3377160==    at 0x4B15250: rb_dictionary_foreach_start (dictionary.c:561)
==3377160==    by 0x485D4F3: configure_authd (authproc.c:355)
==3377160==    by 0x486D2C0: solanum_main (ircd.c:737)
==3377160==    by 0x4940D09: (below main) (libc-start.c:308)
==3377160==  If you believe this happened as a result of a stack
==3377160==  overflow in your program's main thread (unlikely but
==3377160==  possible), you can try to increase the size of the
==3377160==  main thread stack using the --main-stacksize= flag.
==3377160==  The main thread stack size used in this run was 8388608.
==3377160== 
==3377160== HEAP SUMMARY:
==3377160==     in use at exit: 550,829 bytes in 7,327 blocks
==3377160==   total heap usage: 8,797 allocs, 1,470 frees, 1,385,866 bytes allocated
==3377160== 
==3377160== LEAK SUMMARY:
==3377160==    definitely lost: 0 bytes in 0 blocks
==3377160==    indirectly lost: 0 bytes in 0 blocks
==3377160==      possibly lost: 126,109 bytes in 3,332 blocks
==3377160==    still reachable: 424,720 bytes in 3,995 blocks
==3377160==         suppressed: 0 bytes in 0 blocks
==3377160== Rerun with --leak-check=full to see details of leaked memory
==3377160== 
==3377160== For lists of detected and suppressed errors, rerun with: -s
==3377160== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
[1]    3377160 segmentation fault  valgrind solanum -foreground -configfile /tmp/conf.txt