Bug#859653: ntopng: Segmentation fault with mysql

[Ludovico Cavedon]

package ntopng
tags 859653 + pending
thanks

On Sat, May 6, 2017 at 4:57 PM Bernhard Übelacker 
wrote:

> Attached are two patches:
>

Thank you, Bernhard. They look good and I am including them in the upcoming
upload.

Ludovico


>
> - 0001-Avoid-access-after-free.patch
>   (Unrelated to this bug, just received the output from valgrind.)
>
> - 0002-Avoid-access-to-unintialized-memory.patch
>   (With this applied ntopng is not crashing for me; similar change
>got applied upstream in
>
> https://github.com/ntop/ntopng/commit/2d2e735c99064e8f45c38199e810b121d2b5f4b1
> )
>
> Was tested just as far as starting and stopping the service is involved.
>
> Kind regards,
> Bernhard
>
>
>
>
> echo '-F="mysql;localhost;ntopng;flows;ntopng;simple"' >> /etc/ntopng.conf
>
> mysql -u root -p
> CREATE USER 'ntopng'@'localhost' IDENTIFIED BY 'simple';
> create database ntopng;
> GRANT ALL PRIVILEGES ON ntopng.* To 'ntopng'@'localhost' IDENTIFIED
> BY 'simple';
> exit
>
>
> systemctl start ntopng
> Job for ntopng.service failed because a fatal signal was delivered causing
> the control process to dump core.
> See "systemctl status ntopng.service" and "journalctl -xe" for details.
>
>
> journalctl -u ntopng
> Mai 06 15:52:42 debian systemd[1]: Starting ntopng - High-Speed Web-based
> Traffic Analysis and Flow Collection Tool...
> Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42 [Prefs.cpp:919]
> Logging into /var/log/ntopng/ntopng.log
> Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42 [Ntop.cpp:1121]
> Setting local networks to 127.0.0.0/8
> Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42 [Redis.cpp:92]
> Successfully connected to redis 127.0.0.1:6379@0
> Mai 06 15:52:42 debian ntopng[9957]: [NDPI]
> ndpi_init_protocol_defaults(missing protoId=226) INTERNAL ERROR: not all
> protocols have been initialized
> Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42
> [MySQLDB.cpp:495] Attempting to connect to MySQL for interface dummy...
> Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42
> [MySQLDB.cpp:535] Succesfully connected to MySQL [localhost:ntopng] for
> interface dummy
> Mai 06 15:52:45 debian ntopng[9957]: 06/May/2017 15:52:45
> [MySQLDB.cpp:297] MySQL schema update. Altering table flowsv4: renaming
> BYTES to IN_BYTES and adding OUT_BYTES
> Mai 06 15:52:46 debian ntopng[9957]: 06/May/2017 15:52:46
> [MySQLDB.cpp:297] MySQL schema update. Altering table flowsv6: renaming
> BYTES to IN_BYTES and adding OUT_BYTES
> Mai 06 15:52:48 debian systemd[1]: ntopng.service: Control process exited,
> code=dumped status=11
> Mai 06 15:52:48 debian systemd[1]: Failed to start ntopng - High-Speed
> Web-based Traffic Analysis and Flow Collection Tool.
> Mai 06 15:52:48 debian systemd[1]: ntopng.service: Unit entered failed
> state.
> Mai 06 15:52:48 debian systemd[1]: ntopng.service: Failed with result
> 'core-dump'.
> Mai 06 15:52:48 debian systemd[1]: ntopng.service: Service hold-off time
> over, scheduling restart.
> Mai 06 15:52:48 debian systemd[1]: Stopped ntopng - High-Speed Web-based
> Traffic Analysis and Flow Collection Tool.
>
>
> dmesg -T
> [Sa Mai  6 15:52:47 2017] ntopng[9957]: segfault at 7fffc2e9 ip
> 55bfbe6c0ffe sp 7fffc2e8cee0 error 4 in ntopng[55bfbe6ac000+8a000]
>
>
> root@debian:/home/benutzer/debian/ntopng/ntopng/orig/ntopng-2.4+dfsg1/src#
> coredumpctl gdb 9957
> ...
> Core was generated by `/usr/sbin/ntopng /etc/ntopng.conf'.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  0x55bfbe6c0ffe in MySQLDB::MySQLDB (this=0x55bfc0eec850,
> _iface=) at src/MySQLDB.cpp:307
> 307   exec_sql_query(, sql, true, true);
>
> (gdb) bt
> #0  0x55bfbe6c0ffe in MySQLDB::MySQLDB (this=0x55bfc0eec850,
> _iface=) at src/MySQLDB.cpp:307
> #1  0x55bfbe6e35f0 in NetworkInterface::NetworkInterface
> (this=0x55bfbffa7fb0, name=0x55bfbe715310 "dummy") at
> src/NetworkInterface.cpp:133
> #2  0x55bfbe6c6042 in Prefs::add_default_interfaces (this= out>) at src/Prefs.cpp:1059
> #3  0x55bfbe6bc7d4 in main (argc=2, argv=0x7fffc2e8f298) at
> src/main.cpp:117
>
>
> root@debian:/home/benutzer/debian/ntopng/ntopng/orig/ntopng-2.4+dfsg1/src#
> valgrind /usr/sbin/ntopng /etc/ntopng.conf
> ==10143== Memcheck, a memory error detector
> ==10143== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
> ==10143== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for
> copyright info
> ==10143== Command: /usr/sbin/ntopng /etc/ntopng.conf
> ==10143==
> 06/May/2017 16:27:49 [Prefs.cpp:919] Logging into
> /var/log/ntopng/ntopng.log
> 06/May/2017 16:27:49 [Ntop.cpp:1121] Setting local networks to 127.0.0.0/8
> 06/May/2017  16:27:49 [Redis.cpp:92]
> Successfully connected to redis 127.0.0.1:6379@0
> [NDPI] ndpi_init_protocol_defaults(missing protoId=226) INTERNAL ERROR:
> not all protocols have been initialized
> 06/May/2017 16:27:49 [MySQLDB.cpp:495] Attempting to connect to 

Bug#859653: ntopng: Segmentation fault with mysql

[Juri Grabowski]

Hello,

it looks good.

I have build a debian package with

apt-get source ntopng
cd ntopng-2.4+dfsg1
cp 000*.patch ../debian/patches/
dpkg-buildpackage -uc -us

and installed it with 
dpkg -i ../*.deb ; apt-get -f install


Is it possible to get the patched version for debian stretch in debian
depot?

Best regards,
Juri Grabowski

Bug#859653: ntopng: Segmentation fault with mysql

[Bernhard Übelacker]

Hello,
not being maintainer for ntopng I tried to reproduce the issue by
the steps below.

The crash happens because in MySQLDB.cpp this loop breaks only after
4 iterations instead of 2:

  const u_int16_t ipvers[2] = {4, 6};
  for (u_int16_t i = 0; i < sizeof(ipvers); i++){

Attached are two patches:

- 0001-Avoid-access-after-free.patch
  (Unrelated to this bug, just received the output from valgrind.)

- 0002-Avoid-access-to-unintialized-memory.patch
  (With this applied ntopng is not crashing for me; similar change
   got applied upstream in
   
https://github.com/ntop/ntopng/commit/2d2e735c99064e8f45c38199e810b121d2b5f4b1 )

Was tested just as far as starting and stopping the service is involved.

Kind regards,
Bernhard




echo '-F="mysql;localhost;ntopng;flows;ntopng;simple"' >> /etc/ntopng.conf

mysql -u root -p
CREATE USER 'ntopng'@'localhost' IDENTIFIED BY 'simple';
create database ntopng;
GRANT ALL PRIVILEGES ON ntopng.* To 'ntopng'@'localhost' IDENTIFIED BY 
'simple';
exit


systemctl start ntopng
Job for ntopng.service failed because a fatal signal was delivered causing the 
control process to dump core.
See "systemctl status ntopng.service" and "journalctl -xe" for details.


journalctl -u ntopng
Mai 06 15:52:42 debian systemd[1]: Starting ntopng - High-Speed Web-based 
Traffic Analysis and Flow Collection Tool...
Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42 [Prefs.cpp:919] 
Logging into /var/log/ntopng/ntopng.log
Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42 [Ntop.cpp:1121] 
Setting local networks to 127.0.0.0/8
Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42 [Redis.cpp:92] 
Successfully connected to redis 127.0.0.1:6379@0
Mai 06 15:52:42 debian ntopng[9957]: [NDPI] ndpi_init_protocol_defaults(missing 
protoId=226) INTERNAL ERROR: not all protocols have been initialized
Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42 [MySQLDB.cpp:495] 
Attempting to connect to MySQL for interface dummy...
Mai 06 15:52:42 debian ntopng[9957]: 06/May/2017 15:52:42 [MySQLDB.cpp:535] 
Succesfully connected to MySQL [localhost:ntopng] for interface dummy
Mai 06 15:52:45 debian ntopng[9957]: 06/May/2017 15:52:45 [MySQLDB.cpp:297] 
MySQL schema update. Altering table flowsv4: renaming BYTES to IN_BYTES and 
adding OUT_BYTES
Mai 06 15:52:46 debian ntopng[9957]: 06/May/2017 15:52:46 [MySQLDB.cpp:297] 
MySQL schema update. Altering table flowsv6: renaming BYTES to IN_BYTES and 
adding OUT_BYTES
Mai 06 15:52:48 debian systemd[1]: ntopng.service: Control process exited, 
code=dumped status=11
Mai 06 15:52:48 debian systemd[1]: Failed to start ntopng - High-Speed 
Web-based Traffic Analysis and Flow Collection Tool.
Mai 06 15:52:48 debian systemd[1]: ntopng.service: Unit entered failed state.
Mai 06 15:52:48 debian systemd[1]: ntopng.service: Failed with result 
'core-dump'.
Mai 06 15:52:48 debian systemd[1]: ntopng.service: Service hold-off time over, 
scheduling restart.
Mai 06 15:52:48 debian systemd[1]: Stopped ntopng - High-Speed Web-based 
Traffic Analysis and Flow Collection Tool.


dmesg -T
[Sa Mai  6 15:52:47 2017] ntopng[9957]: segfault at 7fffc2e9 ip 
55bfbe6c0ffe sp 7fffc2e8cee0 error 4 in ntopng[55bfbe6ac000+8a000]


root@debian:/home/benutzer/debian/ntopng/ntopng/orig/ntopng-2.4+dfsg1/src# 
coredumpctl gdb 9957
...
Core was generated by `/usr/sbin/ntopng /etc/ntopng.conf'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x55bfbe6c0ffe in MySQLDB::MySQLDB (this=0x55bfc0eec850, 
_iface=) at src/MySQLDB.cpp:307
307   exec_sql_query(, sql, true, true);

(gdb) bt
#0  0x55bfbe6c0ffe in MySQLDB::MySQLDB (this=0x55bfc0eec850, 
_iface=) at src/MySQLDB.cpp:307
#1  0x55bfbe6e35f0 in NetworkInterface::NetworkInterface 
(this=0x55bfbffa7fb0, name=0x55bfbe715310 "dummy") at 
src/NetworkInterface.cpp:133
#2  0x55bfbe6c6042 in Prefs::add_default_interfaces (this=) 
at src/Prefs.cpp:1059
#3  0x55bfbe6bc7d4 in main (argc=2, argv=0x7fffc2e8f298) at src/main.cpp:117


root@debian:/home/benutzer/debian/ntopng/ntopng/orig/ntopng-2.4+dfsg1/src# 
valgrind /usr/sbin/ntopng /etc/ntopng.conf
==10143== Memcheck, a memory error detector
==10143== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==10143== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright info
==10143== Command: /usr/sbin/ntopng /etc/ntopng.conf
==10143== 
06/May/2017 16:27:49 [Prefs.cpp:919] Logging into /var/log/ntopng/ntopng.log
06/May/2017 16:27:49 [Ntop.cpp:1121] Setting local networks to 127.0.0.0/8
06/May/2017 16:27:49 [Redis.cpp:92] Successfully connected to redis 
127.0.0.1:6379@0
[NDPI] ndpi_init_protocol_defaults(missing protoId=226) INTERNAL ERROR: not all 
protocols have been initialized
06/May/2017 16:27:49 [MySQLDB.cpp:495] Attempting to connect to MySQL for 
interface dummy...
06/May/2017 16:27:50 [MySQLDB.cpp:535] Succesfully connected to MySQL 
[localhost:ntopng] for interface dummy
==10143== Invalid read 

Bug#859653: ntopng: Segmentation fault with mysql

[debian-bugs]

dmesg output:
[Wed Apr  5 09:14:11 2017] ntopng[5476]: segfault at 7ffe507c7000 ip 
560e93462ffe sp 7ffe507c3c00 error 4 in ntopng[560e9344e000+8a000]
[Wed Apr  5 09:14:13 2017] ntopng[5486]: segfault at 7fff5c828000 ip 
55b31fd46ffe sp 7fff5c823e10 error 4 in ntopng[55b31fd32000+8a000]
[Wed Apr  5 09:14:14 2017] ntopng[5489]: segfault at 7ffd4ce5 ip 
556b06ef1ffe sp 7ffd4ce4d800 error 4 in ntopng[556b06edd000+8a000]
[Wed Apr  5 09:14:17 2017] ntopng[5493]: segfault at 7ffceff51000 ip 
5648480d9ffe sp 7ffceff4cdd0 error 4 in ntopng[5648480c5000+8a000]
[Wed Apr  5 09:14:19 2017] ntopng[5496]: segfault at 7ffc7cbb6000 ip 
564307584ffe sp 7ffc7cbb2270 error 4 in ntopng[56430757+8a000]
[Wed Apr  5 09:14:21 2017] ntopng[5499]: segfault at 7ffc12f5c000 ip 
55724f8c2ffe sp 7ffc12f58a30 error 4 in ntopng[55724f8ae000+8a000]
[Wed Apr  5 09:14:23 2017] ntopng[5502]: segfault at 721ab000 ip 
56399b218ffe sp 721a6870 error 4 in ntopng[56399b204000+8a000]
[Wed Apr  5 09:14:25 2017] ntopng[5506]: segfault at 7ffece96d000 ip 
561ed1589ffe sp 7ffece969d20 error 4 in ntopng[561ed1575000+8a000]
[Wed Apr  5 09:14:28 2017] ntopng[5511]: segfault at 7ffe902e ip 
56216eb96ffe sp 7ffe902dbb80 error 4 in ntopng[56216eb82000+8a000]
[Wed Apr  5 09:14:30 2017] ntopng[5514]: segfault at 7ffd7d323000 ip 
5567c50d2ffe sp 7ffd7d31f290 error 4 in ntopng[5567c50be000+8a000]
[Wed Apr  5 09:14:32 2017] ntopng[5517]: segfault at 7ffdb0f93000 ip 
5590c171fffe sp 7ffdb0f8f5b0 error 4 in ntopng[5590c170b000+8a000]
[Wed Apr  5 09:17:44 2017] ntopng[5939]: segfault at 7ffe29a0b000 ip 
55d940272ffe sp 7ffe29a068e0 error 4 in ntopng[55d94025e000+8a000]
[Wed Apr  5 09:17:47 2017] ntopng[5944]: segfault at 7ffd2d642000 ip 
557cf8c06ffe sp 7ffd2d63dee0 error 4 in ntopng[557cf8bf2000+8a000]
[Wed Apr  5 09:17:49 2017] ntopng[5947]: segfault at 7ffe3a407000 ip 
55f54dc7cffe sp 7ffe3a4030d0 error 4 in ntopng[55f54dc68000+8a000]
[Wed Apr  5 09:17:51 2017] ntopng[5950]: segfault at 7fff45c4d000 ip 
55d7f78cbffe sp 7fff45c4a090 error 4 in ntopng[55d7f78b7000+8a000]
[Wed Apr  5 09:17:53 2017] ntopng[5953]: segfault at 7fff366d1000 ip 
55b18eedeffe sp 7fff366ccad0 error 4 in ntopng[55b18eeca000+8a000]
[Wed Apr  5 09:17:55 2017] ntopng[5957]: segfault at 7fffdfb17000 ip 
55c1d2864ffe sp 7fffdfb12eb0 error 4 in ntopng[55c1d285+8a000]
[Wed Apr  5 09:17:58 2017] ntopng[5960]: segfault at 7ffca3912000 ip 
55f3133dfffe sp 7ffca390df10 error 4 in ntopng[55f3133cb000+8a000]
[Wed Apr  5 09:18:00 2017] ntopng[5963]: segfault at 7fff2a29f000 ip 
55771589dffe sp 7fff2a29ae30 error 4 in ntopng[557715889000+8a000]
[Wed Apr  5 09:18:01 2017] ntopng[5966]: segfault at 7ffca0c55000 ip 
55eeb0892ffe sp 7ffca0c525e0 error 4 in ntopng[55eeb087e000+8a000]
[Wed Apr  5 09:18:03 2017] ntopng[5969]: segfault at 7ffc98794000 ip 
55f774d76ffe sp 7ffc987912c0 error 4 in ntopng[55f774d62000+8a000]
[Wed Apr  5 09:18:05 2017] ntopng[5972]: segfault at 7ffed608e000 ip 
55e80c866ffe sp 7ffed608a670 error 4 in ntopng[55e80c852000+8a000]
[Wed Apr  5 09:18:08 2017] ntopng[5975]: segfault at 7ffd01cbf000 ip 
5619f1203ffe sp 7ffd01cbac00 error 4 in ntopng[5619f11ef000+8a000]
[Wed Apr  5 09:18:10 2017] ntopng[5978]: segfault at 7ffe2e374000 ip 
561e83c5dffe sp 7ffe2e370cf0 error 4 in ntopng[561e83c49000+8a000]
[Wed Apr  5 09:18:12 2017] ntopng[5981]: segfault at 7ffc0b45c000 ip 
560b4ff91ffe sp 7ffc0b457a30 error 4 in ntopng[560b4ff7d000+8a000]
[Wed Apr  5 09:18:14 2017] ntopng[5984]: segfault at 7ffeab818000 ip 
558fe78b6ffe sp 7ffeab814330 error 4 in ntopng[558fe78a2000+8a000]
[Wed Apr  5 09:18:16 2017] ntopng[5987]: segfault at 7ffc196ed000 ip 
56405ee9cffe sp 7ffc196ea090 error 4 in ntopng[56405ee88000+8a000]
[Wed Apr  5 09:18:19 2017] ntopng[5990]: segfault at 7ffc904ba000 ip 
5643e411bffe sp 7ffc904b5ee0 error 4 in ntopng[5643e4107000+8a000]
[Wed Apr  5 09:18:21 2017] ntopng[5993]: segfault at 7ffedf3b8000 ip 
560d127caffe sp 7ffedf3b4270 error 4 in ntopng[560d127b6000+8a000]
[Wed Apr  5 09:18:23 2017] ntopng[5996]: segfault at 7ffef9529000 ip 
563a47c9cffe sp 7ffef9524f60 error 4 in ntopng[563a47c88000+8a000]
[Wed Apr  5 09:18:25 2017] ntopng[5999]: segfault at 7ffd3413 ip 
55eda928fffe sp 7ffd3412cef0 error 4 in ntopng[55eda927b000+8a000]
[Wed Apr  5 09:18:27 2017] ntopng[6004]: segfault at 7ffcf0dd6000 ip 
55dcf3210ffe sp 7ffcf0dd2b70 error 4 in ntopng[55dcf31fc000+8a000]
[Wed Apr  5 09:18:29 2017] ntopng[6007]: segfault at 7ffd785b7000 ip 
55cfc7c22ffe sp 7ffd785b2e90 error 4 in ntopng[55cfc7c0e000+8a000]
[Wed Apr  5 09:18:31 2017] ntopng[6010]: segfault at 7ffcb3f88000 ip 
55bd0a7caffe sp 7ffcb3f850b0 error 4 in ntopng[55bd0a7b6000+8a000]
[Wed Apr  5 09:18:33 2017] ntopng[6013]: segfault at