Hello,
I tried to reproduce the stack smashing.
But found that the current package in Debian amd64 testing
looks like it was not build with -fstack-protector-strong.
So could it be that your report was using a local rebuilt package?
Nevertheless it looks like the local variable testname has just a size of
0x1001 bytes.
It gets initialized with the content of parameter rootname.
That has already a length of 0xfaa bytes.
Later another 0xd2 get appended from name_buf - too much for testname.
658 void
659 parse_dir(char *rootname, int extent, int len)
660 {
661 char testname[PATH_MAX+1];
...
766 strcpy(testname, rootname);
767 strcat(testname, name_buf);
Kind regards,
Bernhard
root@debian:/home/benutzer# gdb -q --args isoinfo -i crash.iso
Reading symbols from isoinfo...Reading symbols from
/usr/lib/debug/.build-id/32/df58a272dc3f4c3f28d2b2d4e63b80c785c131.debug...done.
done.
(gdb) b parse_dir
Breakpoint 1 at 0xd020: file
/build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c, line 660.
(gdb) ignore 1 109
Will ignore next 109 crossings of breakpoint 1.
(gdb) directory /home/benutzer/genisoimage/cdrkit-1.1.11/genisoimage/diag/
Source directories searched:
/home/benutzer/genisoimage/cdrkit-1.1.11/genisoimage/diag:$cdir:$cwd
(gdb) run
Starting program: /usr/bin/isoinfo -i crash.iso
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Breakpoint 1, parse_dir (rootname=0x5555557ded80 "/", '\322' <repeats 198
times>, <incomplete sequence \322>..., extent=23, len=2048) at
/build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c:660
660 {
(gdb) print/x sizeof(testname)
$2 = 0x1001
(gdb) # break on all strcat/strcpy to testname in parse_dir
(gdb) b 766
Breakpoint 2 at 0x555555561072: file
/build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c, line 766.
(gdb) b 767
Breakpoint 3 at 0x5555555613e8: file
/build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c, line 767.
(gdb) b 775
Breakpoint 4 at 0x5555555612f8: file
/build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c, line 775.
(gdb) b 776
Breakpoint 5 at 0x55555556130a: file
/build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c, line 776.
(gdb) cont
Continuing.
Breakpoint 2, parse_dir (rootname=0x5555557ded80 "/", '\322' <repeats 198
times>, <incomplete sequence \322>..., extent=23, len=<optimized out>)
at /build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c:766
766 strcpy(testname, rootname);
(gdb) print (size_t (*)(const char *))__strlen_sse2(rootname)
$6 = (size_t (*)(const char *)) 0xfaa
(gdb) cont
Continuing.
Breakpoint 3, parse_dir (rootname=0x5555557ded80 "/", '\322' <repeats 198
times>, <incomplete sequence \322>..., extent=24, len=<optimized out>)
at /build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c:767
767 strcat(testname, name_buf);
(gdb) print (size_t (*)(const char *))__strlen_sse2(testname)
$7 = (size_t (*)(const char *)) 0xfaa
(gdb) print (size_t (*)(const char *))__strlen_sse2(name_buf)
$8 = (size_t (*)(const char *)) 0x2
(gdb) cont
Continuing.
Breakpoint 3, parse_dir (rootname=0x5555557ded80 "/", '\322' <repeats 198
times>, <incomplete sequence \322>..., extent=24, len=<optimized out>)
at /build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c:767
767 strcat(testname, name_buf);
(gdb) print (size_t (*)(const char *))__strlen_sse2(testname)
$9 = (size_t (*)(const char *)) 0xfaa
(gdb) print (size_t (*)(const char *))__strlen_sse2(name_buf)
$10 = (size_t (*)(const char *)) 0xd2
(gdb) cont
Continuing.
Program received signal SIGSEGV, Segmentation fault.
0x00005555555614be in parse_dir (rootname=0x5555557ded80 "/", '\322' <repeats
198 times>, <incomplete sequence \322>..., extent=<optimized out>,
len=<optimized out>)
at /build/cdrkit-nac9D5/cdrkit-1.1.11/genisoimage/diag/isoinfo.c:785
785 }
