On Sun, Dec 12, 2004 at 05:18:37AM +0000, Steve McIntyre wrote: > David Liontooth <[EMAIL PROTECTED]> wrote: > >Goswin von Brederlow wrote: > >> > >>And now the same with -f please. I didn't see a segfault in the starce > >>and it is probably its child that dies. > >> > >>You can also compile the ud with debug infos and run it in gdb. > >> > >>MfG > >> Goswin > >> > >> > >Hi Goswin, > > > >So this is not behavior others are seeing? > >I have the pleasure of sending you a thousand EBADF reports below -- > >you're likely only interested in the last few lines: > > OK, so I'm bored. I've just looked at the bug and found the > problem. ud's source is quite ugly, suggesting a novice author. I can > recreate the bug quite readily here, and it's crashing down below a > sprintf() call: > > (gdb) bt > #0 0x0000002a956e9980 in strlen () from /lib/libc.so.6 > #1 0x0000002a956b7c75 in vfprintf () from /lib/libc.so.6 > #2 0x0000002a956d6ec5 in vsprintf () from /lib/libc.so.6 > #3 0x0000002a956be50a in sprintf () from /lib/libc.so.6 > #4 0x0000000000401340 in get_kernel_version (kernel_version=0x7fbffff544 > "running Linux 2.6.9", IsCurrent=0) at ud.c:150 > #5 0x00000000004020c5 in main (argc=1, argv=0x7fbffff540) at ud.c:822 > > The reason for this becomes clear once you turn on warnings in the > compilation: > > gcc -DPACKAGE=\"ud\" -DVERSION=\"0.7.1\" -DSTDC_HEADERS=1 -DHAVE_UNISTD_H=1 > -DRETSIGTYPE=void -DHAVE_GETHOSTNAME=1 -I. -I. -g -O2 -Wall -W -c ud.c > ud.c: In function `get_kernel_version': > ud.c:150: warning: implicit declaration of function `ctime' > ud.c:150: warning: format argument is not a pointer (arg 3) > > ctime is returning a pointer rather than an int. Simply adding > "#include <time.h>" to the top of the ud.c source file fixes this > bug. Prototypes are there for a reason! > > Turning on warnings also highlights other silly coding bugs, but I'll > leave those for other people.
Cheers for that, I will prepare an upload to close all the warnings. Steve -- # The Debian Security Audit Project. http://www.debian.org/security/audit