[Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Vlad Skarzhevskyy]

Hi
  We have experimental JSR-82 module that is directly bound to libbluetooth.so
  svn  http://bluecove.googlecode.com/svn/bluecove-gpl/trunk

 Don't worry we also working D-Bus bound module as well....

  Now we just found a small problem in bluez sdp.c. When we are
creating service record that contains SDP_SEQ and its (SEQ) binary
size more then 254 bytes we get *** stack smashing detected *** error.

 For tests SDP_SEQ containing 253 Null elements has been used.

Stack: [0xb512f000,0xb5180000),  sp=0xb517e930,  free space=318k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [libbluetooth.so.2+0xace2]  sdp_append_to_buf+0x22
C  [libbluetooth.so.2+0xde08]  sdp_append_to_pdu+0x98

My entry point to the library is sdp_extract_pdu

  Tested on Fedora 7 2.6.21 i386,  bluez-libs 3.9

  I was looking at the source code for sdp.c 3.25 and can't see any
related changes.

 The code creating the test is in java and it call function in
BlueCoveBlueZ_Tests.c

  How should I approach to fix this bluez?

Regards,
Vlad

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Marcel Holtmann]

Hi Vlad,

>   We have experimental JSR-82 module that is directly bound to libbluetooth.so
>   svn  http://bluecove.googlecode.com/svn/bluecove-gpl/trunk
> 
>  Don't worry we also working D-Bus bound module as well....
> 
>   Now we just found a small problem in bluez sdp.c. When we are
> creating service record that contains SDP_SEQ and its (SEQ) binary
> size more then 254 bytes we get *** stack smashing detected *** error.
> 
>  For tests SDP_SEQ containing 253 Null elements has been used.
> 
> Stack: [0xb512f000,0xb5180000),  sp=0xb517e930,  free space=318k
> Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
> C  [libbluetooth.so.2+0xace2]  sdp_append_to_buf+0x22
> C  [libbluetooth.so.2+0xde08]  sdp_append_to_pdu+0x98
> 
> My entry point to the library is sdp_extract_pdu
> 
>   Tested on Fedora 7 2.6.21 i386,  bluez-libs 3.9
> 
>   I was looking at the source code for sdp.c 3.25 and can't see any
> related changes.
> 
>  The code creating the test is in java and it call function in
> BlueCoveBlueZ_Tests.c
> 
>   How should I approach to fix this bluez?

can you write a quick example in C that would trigger this problem. I
don't see the issue right now. Have to get it through a debugger.

Regards

Marcel



-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Vlad Skarzhevskyy]

Hi Marcel
 I create a small test in C  bluez-sdp-tests.c
 Source code there: http://snapshot.bluecove.org/bluecove-gpl/bluez/test/

 If the SDP binary size is 258  bytes still works OK.
 But when I make it bigger call to sdp_gen_record_pdu will crash.

===================TEST_SEQ_SIZE 125=========================
--- start testing SDP convenrsions ---
create SEQ of 125 elements
call sdp_attr_add
call sdp_gen_record_pdu
pdu.data_size 258
call sdp_extract_pdu
pdu scanned 258
OK
--- tests finished ---
===================TEST_SEQ_SIZE 126=========================
 --- start testing SDP convenrsions ---
create SEQ of 126 elements
call sdp_attr_add
call sdp_gen_record_pdu
*** stack smashing detected ***: target/bluez-tests terminated
make: *** [run] Aborted

Regards,
Vlad

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Bastien Nocera]

On Thu, 2008-02-07 at 13:25 -0500, Vlad Skarzhevskyy wrote:
> Hi Marcel
>  I create a small test in C  bluez-sdp-tests.c
>  Source code there: http://snapshot.bluecove.org/bluecove-gpl/bluez/test/
> 
>  If the SDP binary size is 258  bytes still works OK.
>  But when I make it bigger call to sdp_gen_record_pdu will crash.

Works fine here, no errors from valgrind either. You might want to
upgrade your bluez-libs...

Cheers


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Marcel Holtmann]

Hi Vlad,

>  I create a small test in C  bluez-sdp-tests.c
>  Source code there: http://snapshot.bluecove.org/bluecove-gpl/bluez/test/

what compiler/libc options/versions did you used for bluez-libs and for
the test program?

Regards

Marcel



-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Marcel Holtmann]

Hi Bastien,

> >  I create a small test in C  bluez-sdp-tests.c
> >  Source code there: http://snapshot.bluecove.org/bluecove-gpl/bluez/test/
> > 
> >  If the SDP binary size is 258  bytes still works OK.
> >  But when I make it bigger call to sdp_gen_record_pdu will crash.
> 
> Works fine here, no errors from valgrind either. You might want to
> upgrade your bluez-libs...

a Fedora 8 with an older bluez-libs indeed crashes:

--- start testing SDP convenrsions ---
create SEQ of 126 elements
call sdp_attr_add
call sdp_gen_record_pdu
*** stack smashing detected ***: ./bluez-sdp-tests terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x6c)[0xf2edf7c]
/lib/libc.so.6[0xf2edf08]
/usr/lib/libbluetooth.so.2(_savefpr_14+0x0)[0xffa28b4]
/usr/lib/libbluetooth.so.2[0xffa140c]
/usr/lib/libbluetooth.so.2[0xffa1440]
/usr/lib/libbluetooth.so.2(sdp_gen_record_pdu+0x7c)[0xff9d66c]
./bluez-sdp-tests[0x10001880]
./bluez-sdp-tests[0x100019b0]
/lib/libc.so.6[0xf1fe56c]
/lib/libc.so.6[0xf1fe73c]
======= Memory map: ========
00100000-00103000 r-xp 00100000 00:00 0          [vdso]
0f1e0000-0f35f000 r-xp 00000000 03:03 1081363    /lib/libc-2.7.so
0f35f000-0f36c000 ---p 0017f000 03:03 1081363    /lib/libc-2.7.so
0f36c000-0f370000 r--p 0018c000 03:03 1081363    /lib/libc-2.7.so
0f370000-0f371000 rw-p 00190000 03:03 1081363    /lib/libc-2.7.so
0f371000-0f374000 rw-p 0f371000 00:00 0 
0ff90000-0ffa9000 r-xp 00000000 03:03 2894543    /usr/lib/libbluetooth.so.2.9.0
0ffa9000-0ffb8000 ---p 00019000 03:03 2894543    /usr/lib/libbluetooth.so.2.9.0
0ffb8000-0ffba000 rw-p 00018000 03:03 2894543    /usr/lib/libbluetooth.so.2.9.0
0ffc0000-0ffe0000 r-xp 00000000 03:03 1081360    /lib/ld-2.7.so
0ffef000-0fff0000 r--p 0002f000 03:03 1081360    /lib/ld-2.7.so
0fff0000-0fff1000 rw-p 00030000 03:03 1081360    /lib/ld-2.7.so
10000000-10003000 r-xp 00000000 03:06 3604654    /home/holtmann/bluez-sdp-tests
10012000-10013000 rw-p 00002000 03:06 3604654    /home/holtmann/bluez-sdp-tests
10013000-10034000 rwxp 10013000 00:00 0          [heap]
30013000-30016000 rw-p 30013000 00:00 0 
7fa30000-7fa45000 rw-p 7ffeb000 00:00 0          [stack]
Aborted

However installing the bluez-libs-3.25 I don't see it anymore:

--- start testing SDP convenrsions ---
create SEQ of 126 elements
call sdp_attr_add
call sdp_gen_record_pdu
pdu.data_size 260
call sdp_extract_pdu
pdu scanned 260
OK
--- tests finished ---

Regards

Marcel



-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Vlad Skarzhevskyy]

In fact I used default Fedora 7 and it has bluez-libs 3.9
(libbluetooth.so.2.5.0)

I did source comparison with current sdp.c from bluez-libs 3.25 and I
was not able to see any changer related to this.  So I blindly assumed
this may be a bug.

Once  bluez-libs 3.25 installed (libbluetooth.so.2.9.4) the original
test works fine but when I change the number of records to 215 I get
the same error.  BUT not every run!!!!

--- start testing SDP convenrsions ---
create SEQ of 215 elements
call sdp_attr_add
call sdp_gen_record_pdu
pdu.data_size 438
call sdp_extract_pdu
pdu scanned 438
OK
--- tests finished ---


--- start testing SDP convenrsions ---
create SEQ of 215 elements
call sdp_attr_add
call sdp_gen_record_pdu
make: *** [run] Segmentation fault


If I have  #define TEST_SEQ_SIZE 128  (On bluez-libs 3.25 )
When I run the test if fails every 10-th run.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

Re: [Bluez-devel] sdp_extract_pdu *** stack smashing detected ***

[Vlad Skarzhevskyy]

Just to make it clear  this is the versions.

[root@tor bluez-libs-tests]# gcc --version
gcc (GCC) 4.1.2 20070925 (Red Hat 4.1.2-27)

[root@tor bluez-libs-tests]# uname -a
Linux torv 2.6.21-6.fc7xen #1 SMP Mon Nov 19 07:14:27 EST 2007 i686
i686 i386 GNU/Linux

[root@tor bluez-libs-tests]# ldd ./target/bluez-tests
        linux-gate.so.1 =>  (0x00762000)
        libbluetooth.so.2 => /usr/lib/libbluetooth.so.2 (0x00233000)
        libc.so.6 => /lib/i686/nosegneg/libc.so.6 (0x002b1000)

[root@tor bluez-libs-tests]# file /usr/lib/libbluetooth.so.2
/usr/lib/libbluetooth.so.2: symbolic link to `libbluetooth.so.2.9.4'


[root@tor bluez-libs-tests]# file /usr/lib/libbluetooth.so.2.9.4
/usr/lib/libbluetooth.so.2.9.4: ELF 32-bit LSB shared object, Intel
80386, version 1 (SYSV), not stripped

-- 
Vlad

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel