invalid next size

[MickMouse]

Hi,

Grab this latest git and compile on latest Debian 10.2.
When try to test pre:

[14:02:47] [L] site pre TEST-UNKNOWN mp3
[14:02:47] [L] 200- malloc(): invalid next size (unsorted)
[14:02:47] [L] 200- Aborted
[14:02:47] [L] 200 Command Successful.

[glftpd]

please compile it with debug info and try to either get core dump or attach debugger to the crash

(debug info can be enabled by editing Makefile.config and changing -O2 to -g, you can attach debugger by adding some Sleep() into the main code and attaching gdb to the pid while it sleeps)

[MickMouse]

Hi

See the following in dmesg:
[Tue Dec 10 13:45:24 2019] foo-pre[4218]: segfault at 0 ip 000055d731d32fd4 sp 00007fff49842a30 error 4 in foo-pre[55d731d2f000+8000]
[Tue Dec 10 13:45:24 2019] Code: 48 33 14 25 28 00 00 00 75 05 48 83 c4 18 c3 e8 b2 c1 ff ff 66 90 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <48> 83 3f 00 0f 95 c0 48 8b 54 24 08 64 48 33 14 25 28 00 00 00 75
[Tue Dec 10 13:45:35 2019] foo-pre[4221]: segfault at 0 ip 0000560869760fd4 sp 00007ffc594e1a30 error 4 in foo-pre[56086975d000+8000]
[Tue Dec 10 13:45:35 2019] Code: 48 33 14 25 28 00 00 00 75 05 48 83 c4 18 c3 e8 b2 c1 ff ff 66 90 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <48> 83 3f 00 0f 95 c0 48 8b 54 24 08 64 48 33 14 25 28 00 00 00 75
[Tue Dec 10 13:46:57 2019] foo-pre[4310]: segfault at 0 ip 00005619ad1d0d04 sp 00007ffe4d595b10 error 4 in foo-pre[5619ad1cc000+9000]
[Tue Dec 10 13:46:57 2019] Code: 48 33 14 25 28 00 00 00 75 05 48 83 c4 18 c3 e8 62 b4 ff ff 66 90 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <48> 83 3f 00 0f 95 c0 48 8b 54 24 08 64 48 33 14 25 28 00 00 00 75
[Tue Dec 10 13:47:58 2019] foo-pre[4611]: segfault at 0 ip 000056215bea1fd4 sp 00007fff9555e990 error 4 in foo-pre[56215be9e000+8000]
[Tue Dec 10 13:47:58 2019] Code: 48 33 14 25 28 00 00 00 75 05 48 83 c4 18 c3 e8 b2 c1 ff ff 66 90 48 83 ec 18 64 48 8b 04 25 28 00 00 00 48 89 44 24 08 31 c0 <48> 83 3f 00 0f 95 c0 48 8b 54 24 08 64 48 33 14 25 28 00 00 00 75

Also current the line inside Makefile.config is not with O2 but O0, what else can i do for you to grab you more details?

[MickMouse]

Extra information:

It appears when you just site pre a empty dir nothing goes wrong:
[13:58:18] [R] site pre TEST1-UNKNOWN mp3
[13:58:18] [R] 200- /.__ ________ /
[13:58:18] [R] 200- \ / _ | / __ /__/ _ /
[13:58:18] [R] 200- __ / / // / \ / / ( original f00-pre )
[13:58:18] [R] 200- / / /_\ / ________________________
[13:58:18] [R] 200- / / ( / /
[13:58:18] [R] 200- / /
[13:58:18] [R] 200- * Looks like this is going to be a UNKNOWN pre..
[13:58:18] [R] 200- * Destination for pre will be the mp3 section..
[13:58:18] [R] 200- * Totals of this pre for announce: 0F 0.0B
[13:58:18] [R] 200- * Moving files to destination dir..
[13:58:18] [R] 200- -- From: /site/groups/UNKNOWN/TEST1-UNKNOWN
[13:58:18] [R] 200- -- To: /site/incoming/mp3/2019-12-10/TEST1-UNKNOWN Done
[13:58:18] [R] 200- * Updating userfiles ..
[13:58:18] [R] 200- ________________________________________________
[13:58:18] [R] 200- foo-pre-v3.3 (c) tanesha /_______________
[13:58:18] [R] 200-
[13:58:18] [R] 200 Command Successful.

As soon the directory contains any files then it gives the malloc(): invalid next size (unsorted)
Also here some logging from compile added to this message :)
foo-pre_compilelog.txt

[silv3rr]

you might want to try https://github.com/silv3rr/foo-tools

[MickMouse]

Hi silv3rr,

Compile goes perfect but shows the same behaviour :(
[10:58:45] [L] 200- malloc(): invalid next size (unsorted)
[10:58:45] [L] 200- Aborted
[10:58:45] [L] 200 Command Successful.

[MickMouse]

Hi

I've added sleep(60); inside the code off: int pre(char *section, char *dest, char *src, char *rel, char *group, char *argv[]) { within glftpd site pre dir section, the proccess fall into sleep.

After that i attach gdb to the process:
gdb -p 9326
GNU gdb (Debian 8.2.1-2+b3) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.

For help, type "help".
Type "apropos word" to search for commands related to "word".
Attaching to process 9326
Reading symbols from /jail/glftpd/bin/foo-pre...done.
Reading symbols from /lib/x86_64-linux-gnu/libdl.so.2...Reading symbols from /usr/lib/debug/.build-id/d3/583c742dd47aaa860c5ae0c0c5bdbcd2d54f61.debug...done.
done.
Reading symbols from /lib/x86_64-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug/.build-id/18/b9a9a8c523e5cfe5b5d946d605d09242f09798.debug...done.
done.
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/.build-id/f2/5dfd7b95be4ba386fd71080accae8c0732b711.debug...done.
done.
0x00007f8c56c0c6f4 in __GI___nanosleep (requested_time=requested_time@entry=0x7ffc0a674330, remaining=remaining@entry=0x7ffc0a674330) at ../sysdeps/unix/sysv/linux/nanosleep.c:28
28 ../sysdeps/unix/sysv/linux/nanosleep.c: No such file or directory.
(gdb)
And then? What todo to get more information for you guys?

[MickMouse]

I found out with next i can show more information:

Attached the output of gdb before it reaches a SIGABRT
foo-pre_gdblog.txt

[glftpd]

thanks nice progress

after the SIGABRT do a "bt full" to get info where it happened

also you can use "step" to go into the function where it crashed (userfile_update) instead of using next

[MickMouse]

Hi

See the 2 files added it shows a more detailed overview what happens, i'll try to do some more with using step :)

foo-pre_gdblog_#1.txt
foo-pre_gdblog_#2.txt

[glftpd]

thanks ill have a look

[glftpd]

I dont see an error directly around the point of crash just yet but the error indicates a memory corruption which could have happened earlier. Could you compile with these flags which might give us the error when it happens ?
-g -fsanitize=address -fsanitize=undefined -D_FORTIFY_SOURCE=2 -fstack-protector-all

[MickMouse]

Hi

I've changed Makefile.config to have the line CC = gcc -g -fsanitize=address -fsanitize=undefined -D_FORTIFY_SOURCE=2 -fstack-protector-all which give a shitload off error :) but foo-pre does compile but as soon you run it: site pre the following error show within glftpd (after a few libs have been copyed to /lib dir inside glftpd)

[10:50:19] [L] site pre
[10:50:19] [L] 200- ==7365==WARNING: reading executable name failed with errno 2, some stack frames may not be symbolized
[10:50:19] [L] 200- ==7365==WARNING: reading executable name failed with errno 2, some stack frames may not be symbolized
[10:50:19] [L] 200- ==7365==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_procmaps_common.cc:75 "((data_.proc_self_maps.len)) > ((0))" (0x0, 0x0)
[10:50:19] [L] 200-
[10:50:19] [L] 200-
[10:50:19] [L] 200 Command Successful.

Here the small log within ../pre/
/jail/sources/foo-tools-master_glftpd/src/pre# make
gcc -g -fsanitize=address -fsanitize=undefined -D_FORTIFY_SOURCE=2 -fstack-protector-all -c foo-pre.c -I..
foo-pre.c: In function ‘filelist_find_by_dir’:
foo-pre.c:614:4: warning: implicit declaration of function ‘touch_dir’; did you mean ‘fchdir’? [-Wimplicit-function-declaration]
touch_dir(buf);
^~~~~~~~~
fchdir
foo-pre.c:626:4: warning: implicit declaration of function ‘touch_file’; did you mean ‘flockfile’? [-Wimplicit-function-declaration]
touch_file(buf);
^~~~~~~~~~
flockfile
foo-pre.c: In function ‘pre_do_modules’:
foo-pre.c:978:3: warning: ‘return’ with no value, in function returning non-void
return;
^~~~~~
foo-pre.c:969:5: note: declared here
int pre_do_modules(filelist_t *files, char *path, char *argv[], struct subdir_list *subdirs) {
^~~~~~~~~~~~~~
foo-pre.c: In function ‘pre’:
foo-pre.c:1061:25: warning: implicit declaration of function ‘get_mp3_genre’ [-Wimplicit-function-declaration]
sprintf(gtmp, "%s", get_mp3_genre(buf));
^~~~~~~~~~~~~
gcc -g -fsanitize=address -fsanitize=undefined -D_FORTIFY_SOURCE=2 -fstack-protector-all -c gl_userfile.c -I..
make -C mp3genre
make[1]: Entering directory '/jail/sources/foo-tools-master_glftpd/src/pre/mp3genre'
gcc -g -fsanitize=address -fsanitize=undefined -D_FORTIFY_SOURCE=2 -fstack-protector-all -c mp3genre.c -o mp3genre.o
mp3genre.c: In function ‘get_mp3_genre’:
mp3genre.c:30:8: warning: implicit declaration of function ‘strcmp’ [-Wimplicit-function-declaration]
if (!strcmp((const char *)"TAG",(const char *)mp3_fbuf)) {
^~~~~~
make[1]: Leaving directory '/jail/sources/foo-tools-master_glftpd/src/pre/mp3genre'
gcc -g -fsanitize=address -fsanitize=undefined -D_FORTIFY_SOURCE=2 -fstack-protector-all -o foo-pre foo-pre.o ../collection/strlist.o ../lib/gllogs.o ../lib/pwdfile.o ../util/linefilereader.o ../collection/hashtable.o ../lib/stringtokenizer.o ./gl_userfile.o ./mp3genre/mp3genre.o -ldl
config.log

[glftpd]

ok but what happens when you add the sleep and use the gdb like before ? those compilation warnings just mean the code is crap but everyone knew that :)

[MickMouse]

Hi,

placed the sleep inside: int main(int argc, char *argv[]) {
glftpd show the same error while running site pre

[11:27:59] [L] site pre
[11:27:59] [L] 200- ==3968==WARNING: reading executable name failed with errno 2, some stack frames may not be symbolized
[11:27:59] [L] 200- ==3968==WARNING: reading executable name failed with errno 2, some stack frames may not be symbolized
[11:27:59] [L] 200- ==3968==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_procmaps_common.cc:75 "((data_.proc_self_maps.len)) > ((0))" (0x0, 0x0)
[11:27:59] [L] 200-
[11:27:59] [L] 200-
[11:27:59] [L] 200 Command Successful.

[MickMouse]

Running the ./foo-pre from command line and attached gdb:
gdb -p 5724
GNU gdb (Debian 8.2.1-2+b3) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.

For help, type "help".
Type "apropos word" to search for commands related to "word".
Attaching to process 5724
Reading symbols from /jail/glftpd/bin/foo-pre...done.
Reading symbols from /lib/x86_64-linux-gnu/libasan.so.5...Reading symbols from /usr/lib/debug/.build-id/3c/f2e4b5261216f9a156ed5dc2953d8b6f98987d.debug...done.
done.
Reading symbols from /lib/x86_64-linux-gnu/libdl.so.2...Reading symbols from /usr/lib/debug/.build-id/d3/583c742dd47aaa860c5ae0c0c5bdbcd2d54f61.debug...done.
done.
Reading symbols from /lib/x86_64-linux-gnu/libubsan.so.1...(no debugging symbols found)...done.
Reading symbols from /lib/x86_64-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug/.build-id/18/b9a9a8c523e5cfe5b5d946d605d09242f09798.debug...done.
done.
Reading symbols from /lib/x86_64-linux-gnu/librt.so.1...Reading symbols from /usr/lib/debug/.build-id/5d/cf98ad684962be494af28a1051793fd39e4ebc.debug...done.
done.
Reading symbols from /lib/x86_64-linux-gnu/libpthread.so.0...Reading symbols from /usr/lib/debug/.build-id/e9/1114987a0147bd050addbd591eb8994b29f4b3.debug...done.
done.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Reading symbols from /lib/x86_64-linux-gnu/libstdc++.so.6...(no debugging symbols found)...done.
Reading symbols from /lib/x86_64-linux-gnu/libm.so.6...Reading symbols from /usr/lib/debug/.build-id/88/5dda4b4a5cea600e7b5b98c1ad86996c8d2299.debug...done.
done.
Reading symbols from /lib/x86_64-linux-gnu/libgcc_s.so.1...(no debugging symbols found)...done.
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/.build-id/f2/5dfd7b95be4ba386fd71080accae8c0732b711.debug...done.
done.
0x00007f69dcd9e6f4 in __GI___nanosleep (requested_time=0x7fff60a0edf0, remaining=0x7fff60a0edf0) at ../sysdeps/unix/sysv/linux/nanosleep.c:28
28 ../sysdeps/unix/sysv/linux/nanosleep.c: No such file or directory.
(gdb) next
__sleep (seconds=0) at ../sysdeps/posix/sleep.c:62
62 ../sysdeps/posix/sleep.c: No such file or directory.
(gdb) next
64 in ../sysdeps/posix/sleep.c
(gdb) next
main (argc=1, argv=0x7fff60a0ef38) at foo-pre.c:1447
1447 pre_init();
(gdb) next
[Inferior 1 (process 5724) exited with code 01]
(gdb) next
The program is not being run.
(gdb)

Did not find environment for glftpd, please run only from within glftpd as 'site' command!
==5724==LeakSanitizer has encountered a fatal error.
==5724==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
==5724==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)