search

spamhaus / pdns-logger

pdns-logger is a small daemon that will accept connections from the protobuf channel of powerdns-reursor and will log queries in several formats
Mozilla Public License 2.0
15 stars 8 forks source link

*** buffer overflow detected *** when only-rewrites=0 #3

Open efbertos opened 5 years ago

efbertos commented 5 years ago

strace_pdns-logger.txt [pdns-logger@powerdns root]$ pdns_recursor --version Aug 19 11:03:44 PowerDNS Recursor 4.2.0 (C) 2001-2019 PowerDNS.COM BV

[root@powerdns system]# uname -a Linux powerdns 3.10.0-957.27.2.el7.x86_64 #1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

[root@powerdns system]# cat /etc/*release CentOS Linux release 7.6.1810 (Core)

[root@powerdns system]# /usr/sbin/pdns-logger -f syslog: Disabled according to configuration logsqlite: Disabled according to configuration Connection from host 127.0.0.1, port 55818. Connection from host 127.0.0.1, port 55820. Connection from host 127.0.0.1, port 55822. Connection from host 127.0.0.1, port 55824. buffer overflow detected : /usr/sbin/pdns-logger terminated ======= Backtrace: ========= /lib64/libc.so.6(__fortify_fail+0x37)[0x7f6a4cdaeb67] /lib64/libc.so.6(+0x115ce2)[0x7f6a4cdacce2] /lib64/libc.so.6(__strncat_chk+0x13c)[0x7f6a4cdabf4c] /usr/sbin/pdns-logger[0x40422c] /usr/sbin/pdns-logger(pdns_loggers_log+0x28)[0x405268] /usr/sbin/pdns-logger[0x40485d] /lib64/libpthread.so.0(+0x7dd5)[0x7f6a4d320dd5] /lib64/libc.so.6(clone+0x6d)[0x7f6a4cd9502d] ======= Memory map: ======== 00400000-00408000 r-xp 00000000 fd:00 712680 /usr/sbin/pdns-logger 00608000-0060a000 r--p 00008000 fd:00 712680 /usr/sbin/pdns-logger 0060a000-0060b000 rw-p 0000a000 fd:00 712680 /usr/sbin/pdns-logger 024c3000-024e4000 rw-p 00000000 00:00 0 [heap] 7f6a3c000000-7f6a3c021000 rw-p 00000000 00:00 0 7f6a3c021000-7f6a40000000 ---p 00000000 00:00 0 7f6a44000000-7f6a44021000 rw-p 00000000 00:00 0 7f6a44021000-7f6a48000000 ---p 00000000 00:00 0 7f6a4a879000-7f6a4a88e000 r-xp 00000000 fd:00 75 /usr/lib64/libgcc_s-4.8.5-20150702.so.1 7f6a4a88e000-7f6a4aa8d000 ---p 00015000 fd:00 75 /usr/lib64/libgcc_s-4.8.5-20150702.so.1 7f6a4aa8d000-7f6a4aa8e000 r--p 00014000 fd:00 75 /usr/lib64/libgcc_s-4.8.5-20150702.so.1 7f6a4aa8e000-7f6a4aa8f000 rw-p 00015000 fd:00 75 /usr/lib64/libgcc_s-4.8.5-20150702.so.1 7f6a4aa8f000-7f6a4aa90000 ---p 00000000 00:00 0 7f6a4aa90000-7f6a4b290000 rw-p 00000000 00:00 0 7f6a4b290000-7f6a4b291000 ---p 00000000 00:00 0 7f6a4b291000-7f6a4ba91000 rw-p 00000000 00:00 0 7f6a4ba91000-7f6a4ba92000 ---p 00000000 00:00 0 7f6a4ba92000-7f6a4c292000 rw-p 00000000 00:00 0 7f6a4c292000-7f6a4c293000 ---p 00000000 00:00 0 7f6a4c293000-7f6a4ca93000 rw-p 00000000 00:00 0 7f6a4ca93000-7f6a4ca95000 r-xp 00000000 fd:00 7545 /usr/lib64/libdl-2.17.so 7f6a4ca95000-7f6a4cc95000 ---p 00002000 fd:00 7545 /usr/lib64/libdl-2.17.so 7f6a4cc95000-7f6a4cc96000 r--p 00002000 fd:00 7545 /usr/lib64/libdl-2.17.so 7f6a4cc96000-7f6a4cc97000 rw-p 00003000 fd:00 7545 /usr/lib64/libdl-2.17.so 7f6a4cc97000-7f6a4ce59000 r-xp 00000000 fd:00 7249 /usr/lib64/libc-2.17.so 7f6a4ce59000-7f6a4d059000 ---p 001c2000 fd:00 7249 /usr/lib64/libc-2.17.so 7f6a4d059000-7f6a4d05d000 r--p 001c2000 fd:00 7249 /usr/lib64/libc-2.17.so 7f6a4d05d000-7f6a4d05f000 rw-p 001c6000 fd:00 7249 /usr/lib64/libc-2.17.so 7f6a4d05f000-7f6a4d064000 rw-p 00000000 00:00 0 7f6a4d064000-7f6a4d115000 r-xp 00000000 fd:00 31859 /usr/lib64/libsqlite3.so.0.8.6 7f6a4d115000-7f6a4d314000 ---p 000b1000 fd:00 31859 /usr/lib64/libsqlite3.so.0.8.6 7f6a4d314000-7f6a4d316000 r--p 000b0000 fd:00 31859 /usr/lib64/libsqlite3.so.0.8.6 7f6a4d316000-7f6a4d319000 rw-p 000b2000 fd:00 31859 /usr/lib64/libsqlite3.so.0.8.6 7f6a4d319000-7f6a4d330000 r-xp 00000000 fd:00 7572 /usr/lib64/libpthread-2.17.so 7f6a4d330000-7f6a4d52f000 ---p 00017000 fd:00 7572 /usr/lib64/libpthread-2.17.so 7f6a4d52f000-7f6a4d530000 r--p 00016000 fd:00 7572 /usr/lib64/libpthread-2.17.so 7f6a4d530000-7f6a4d531000 rw-p 00017000 fd:00 7572 /usr/lib64/libpthread-2.17.so 7f6a4d531000-7f6a4d535000 rw-p 00000000 00:00 0 7f6a4d535000-7f6a4d53d000 r-xp 00000000 fd:00 712698 /usr/lib64/libprotobuf-c.so.1.0.0 7f6a4d53d000-7f6a4d73c000 ---p 00008000 fd:00 712698 /usr/lib64/libprotobuf-c.so.1.0.0 7f6a4d73c000-7f6a4d73d000 r--p 00007000 fd:00 712698 /usr/lib64/libprotobuf-c.so.1.0.0 7f6a4d73d000-7f6a4d73e000 rw-p 00008000 fd:00 712698 /usr/lib64/libprotobuf-c.so.1.0.0 7f6a4d73e000-7f6a4d760000 r-xp 00000000 fd:00 350 /usr/lib64/ld-2.17.so 7f6a4d952000-7f6a4d956000 rw-p 00000000 00:00 0 7f6a4d95c000-7f6a4d95f000 rw-p 00000000 00:00 0 7f6a4d95f000-7f6a4d960000 r--p 00021000 fd:00 350 /usr/lib64/ld-2.17.so 7f6a4d960000-7f6a4d961000 rw-p 00022000 fd:00 350 /usr/lib64/ld-2.17.so 7f6a4d961000-7f6a4d962000 rw-p 00000000 00:00 0 7ffc44aa3000-7ffc44ac4000 rw-p 00000000 00:00 0 [stack] 7ffc44ad1000-7ffc44ad3000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

sid3windr commented 4 years ago

Seeing the same issue here...

Thread 2 "pdns-logger" received signal SIGABRT, Aborted. [Switching to Thread 0x7ffff7b23700 (LWP 22223)] __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt

0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

1 0x00007ffff7cd2535 in __GI_abort () at abort.c:79

2 0x00007ffff7d29508 in __libc_message (action=, fmt=fmt@entry=0x7ffff7e3407b " %s : %s terminated\n") at ../sysdeps/posix/libc_fatal.c:181

3 0x00007ffff7dba80d in __GI___fortify_fail_abort (need_backtrace=need_backtrace@entry=true, msg=msg@entry=0x7ffff7e33ff8 "buffer overflow detected") at fortify_fail.c:28

4 0x00007ffff7dba841 in __GI___fortify_fail (msg=msg@entry=0x7ffff7e33ff8 "buffer overflow detected") at fortify_fail.c:44

5 0x00007ffff7db8940 in __GI___chk_fail () at chk_fail.c:28

6 0x00007ffff7db7d93 in __strncat_chk (s1=, s2=, n=, s1len=) at strncat_chk.c:33

7 0x0000000000404108 in logfile_log ()

8 0x0000000000405328 in pdns_loggers_log ()

9 0x000000000040492d in socket_thread_exec ()

10 0x00007ffff7f9afa3 in start_thread (arg=) at pthread_create.c:486

11 0x00007ffff7da94cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

(Probably not a too useful backtrace but posting anyway)

sid3windr commented 4 years ago

Blindly raising the string lengths from 1024 to 4096 in logfile_log() seems to keep it running here.