[LBBS-123] module.c: Use after free with module references

← All Issues || New Issue →

Sort Normal || Priority

Details

==197802== Warning: invalid file descriptor -1 in syscall read()
==197802== Thread 1:
==197802== Invalid read of size 1
==197802==    at 0x4847782: strlen (vg_replace_strmem.c:494)
==197802==    by 0x4F12257: __vfprintf_internal (vfprintf-process-arg.c:397)
==197802==    by 0x13512E: bbs_dprintf (logger.c:411)
==197802==    by 0x1405D8: list_modulerefs (module.c:1455)
==197802==    by 0x141B39: unload_modules_helper (module.c:1969)
==197802==    by 0x141C8B: unload_modules (module.c:1995)
==197802==    by 0x11D6A0: bbs_shutdown (bbs.c:646)
==197802==    by 0x11E1FA: monitor_sig_flags (bbs.c:940)
==197802==    by 0x11F054: main (bbs.c:1250)
==197802==  Address 0x5ffe240 is 208 bytes inside a block of size 218 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x13C010: free_module (module.c:132)
==197802==    by 0x13C309: bbs_module_unregister (module.c:187)
==197802==    by 0x5A9F2F4: __unreg_module (net_ws.c:1311)
==197802==    by 0x4001129: _dl_call_fini (dl-call_fini.c:43)
==197802==    by 0x5003273: _dl_catch_exception (dl-error-skeleton.c:182)
==197802==    by 0x40017C0: _dl_close_worker (dl-close.c:253)
==197802==    by 0x4002025: _dl_close (dl-close.c:778)
==197802==    by 0x5003219: _dl_catch_exception (dl-error-skeleton.c:208)
==197802==    by 0x50032CE: _dl_catch_error (dl-error-skeleton.c:227)
==197802==    by 0x4F38FA6: _dlerror_run (dlerror.c:138)
==197802==    by 0x4F38D05: dlclose@@GLIBC_2.34 (dlclose.c:31)
==197802==  Block was alloc'd at
==197802==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==197802==    by 0x116734: __bbs_calloc (alloc.c:83)
==197802==    by 0x13CEB4: load_dlopen (module.c:380)
==197802==    by 0x13D608: load_dynamic_module (module.c:537)
==197802==    by 0x13E18F: load_resource (module.c:802)
==197802==    by 0x13F3A1: do_autoload_module (module.c:1135)
==197802==    by 0x13FBB6: try_autoload_modules (module.c:1268)
==197802==    by 0x1416E3: load_modules (module.c:1868)
==197802==    by 0x11EF74: main (bbs.c:1216)
==197802==
==197802== Invalid read of size 1
==197802==    at 0x4847794: strlen (vg_replace_strmem.c:494)
==197802==    by 0x4F12257: __vfprintf_internal (vfprintf-process-arg.c:397)
==197802==    by 0x13512E: bbs_dprintf (logger.c:411)
==197802==    by 0x1405D8: list_modulerefs (module.c:1455)
==197802==    by 0x141B39: unload_modules_helper (module.c:1969)
==197802==    by 0x141C8B: unload_modules (module.c:1995)
==197802==    by 0x11D6A0: bbs_shutdown (bbs.c:646)
==197802==    by 0x11E1FA: monitor_sig_flags (bbs.c:940)
==197802==    by 0x11F054: main (bbs.c:1250)
==197802==  Address 0x5ffe241 is 209 bytes inside a block of size 218 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x13C010: free_module (module.c:132)
==197802==    by 0x13C309: bbs_module_unregister (module.c:187)
==197802==    by 0x5A9F2F4: __unreg_module (net_ws.c:1311)
==197802==    by 0x4001129: _dl_call_fini (dl-call_fini.c:43)
==197802==    by 0x5003273: _dl_catch_exception (dl-error-skeleton.c:182)
==197802==    by 0x40017C0: _dl_close_worker (dl-close.c:253)
==197802==    by 0x4002025: _dl_close (dl-close.c:778)
==197802==    by 0x5003219: _dl_catch_exception (dl-error-skeleton.c:208)
==197802==    by 0x50032CE: _dl_catch_error (dl-error-skeleton.c:227)
==197802==    by 0x4F38FA6: _dlerror_run (dlerror.c:138)
==197802==    by 0x4F38D05: dlclose@@GLIBC_2.34 (dlclose.c:31)
==197802==  Block was alloc'd at
==197802==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==197802==    by 0x116734: __bbs_calloc (alloc.c:83)
==197802==    by 0x13CEB4: load_dlopen (module.c:380)
==197802==    by 0x13D608: load_dynamic_module (module.c:537)
==197802==    by 0x13E18F: load_resource (module.c:802)
==197802==    by 0x13F3A1: do_autoload_module (module.c:1135)
==197802==    by 0x13FBB6: try_autoload_modules (module.c:1268)
==197802==    by 0x1416E3: load_modules (module.c:1868)
==197802==    by 0x11EF74: main (bbs.c:1216)
==197802==
==197802== Invalid read of size 1
==197802==    at 0x4F355C9: _IO_new_file_xsputn (fileops.c:1218)
==197802==    by 0x4F355C9: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1196)
==197802==    by 0x4F10C10: outstring_func (vfprintf-internal.c:239)
==197802==    by 0x4F10C10: __vfprintf_internal (vfprintf-process-arg.c:427)
==197802==    by 0x13512E: bbs_dprintf (logger.c:411)
==197802==    by 0x1405D8: list_modulerefs (module.c:1455)
==197802==    by 0x141B39: unload_modules_helper (module.c:1969)
==197802==    by 0x141C8B: unload_modules (module.c:1995)
==197802==    by 0x11D6A0: bbs_shutdown (bbs.c:646)
==197802==    by 0x11E1FA: monitor_sig_flags (bbs.c:940)
==197802==    by 0x11F054: main (bbs.c:1250)
==197802==  Address 0x5ffe248 is 216 bytes inside a block of size 218 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x13C010: free_module (module.c:132)
==197802==    by 0x13C309: bbs_module_unregister (module.c:187)
==197802==    by 0x5A9F2F4: __unreg_module (net_ws.c:1311)
==197802==    by 0x4001129: _dl_call_fini (dl-call_fini.c:43)
==197802==    by 0x5003273: _dl_catch_exception (dl-error-skeleton.c:182)
==197802==    by 0x40017C0: _dl_close_worker (dl-close.c:253)
==197802==    by 0x4002025: _dl_close (dl-close.c:778)
==197802==    by 0x5003219: _dl_catch_exception (dl-error-skeleton.c:208)
==197802==    by 0x50032CE: _dl_catch_error (dl-error-skeleton.c:227)
==197802==    by 0x4F38FA6: _dlerror_run (dlerror.c:138)
==197802==    by 0x4F38D05: dlclose@@GLIBC_2.34 (dlclose.c:31)
==197802==  Block was alloc'd at
==197802==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==197802==    by 0x116734: __bbs_calloc (alloc.c:83)
==197802==    by 0x13CEB4: load_dlopen (module.c:380)
==197802==    by 0x13D608: load_dynamic_module (module.c:537)
==197802==    by 0x13E18F: load_resource (module.c:802)
==197802==    by 0x13F3A1: do_autoload_module (module.c:1135)
==197802==    by 0x13FBB6: try_autoload_modules (module.c:1268)
==197802==    by 0x1416E3: load_modules (module.c:1868)
==197802==    by 0x11EF74: main (bbs.c:1216)
==197802==
==197802== Invalid read of size 1
==197802==    at 0x484BE60: mempcpy (vg_replace_strmem.c:1668)
==197802==    by 0x4F3558B: _IO_new_file_xsputn (fileops.c:1235)
==197802==    by 0x4F3558B: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1196)
==197802==    by 0x4F10C10: outstring_func (vfprintf-internal.c:239)
==197802==    by 0x4F10C10: __vfprintf_internal (vfprintf-process-arg.c:427)
==197802==    by 0x13512E: bbs_dprintf (logger.c:411)
==197802==    by 0x1405D8: list_modulerefs (module.c:1455)
==197802==    by 0x141B39: unload_modules_helper (module.c:1969)
==197802==    by 0x141C8B: unload_modules (module.c:1995)
==197802==    by 0x11D6A0: bbs_shutdown (bbs.c:646)
==197802==    by 0x11E1FA: monitor_sig_flags (bbs.c:940)
==197802==    by 0x11F054: main (bbs.c:1250)
==197802==  Address 0x5ffe240 is 208 bytes inside a block of size 218 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x13C010: free_module (module.c:132)
==197802==    by 0x13C309: bbs_module_unregister (module.c:187)
==197802==    by 0x5A9F2F4: __unreg_module (net_ws.c:1311)
==197802==    by 0x4001129: _dl_call_fini (dl-call_fini.c:43)
==197802==    by 0x5003273: _dl_catch_exception (dl-error-skeleton.c:182)
==197802==    by 0x40017C0: _dl_close_worker (dl-close.c:253)
==197802==    by 0x4002025: _dl_close (dl-close.c:778)
==197802==    by 0x5003219: _dl_catch_exception (dl-error-skeleton.c:208)
==197802==    by 0x50032CE: _dl_catch_error (dl-error-skeleton.c:227)
==197802==    by 0x4F38FA6: _dlerror_run (dlerror.c:138)
==197802==    by 0x4F38D05: dlclose@@GLIBC_2.34 (dlclose.c:31)
==197802==  Block was alloc'd at
==197802==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==197802==    by 0x116734: __bbs_calloc (alloc.c:83)
==197802==    by 0x13CEB4: load_dlopen (module.c:380)
==197802==    by 0x13D608: load_dynamic_module (module.c:537)
==197802==    by 0x13E18F: load_resource (module.c:802)
==197802==    by 0x13F3A1: do_autoload_module (module.c:1135)
==197802==    by 0x13FBB6: try_autoload_modules (module.c:1268)
==197802==    by 0x1416E3: load_modules (module.c:1868)
==197802==    by 0x11EF74: main (bbs.c:1216)
==197802==
==197802== Invalid read of size 1
==197802==    at 0x484BE6E: mempcpy (vg_replace_strmem.c:1668)
==197802==    by 0x4F3558B: _IO_new_file_xsputn (fileops.c:1235)
==197802==    by 0x4F3558B: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1196)
==197802==    by 0x4F10C10: outstring_func (vfprintf-internal.c:239)
==197802==    by 0x4F10C10: __vfprintf_internal (vfprintf-process-arg.c:427)
==197802==    by 0x13512E: bbs_dprintf (logger.c:411)
==197802==    by 0x1405D8: list_modulerefs (module.c:1455)
==197802==    by 0x141B39: unload_modules_helper (module.c:1969)
==197802==    by 0x141C8B: unload_modules (module.c:1995)
==197802==    by 0x11D6A0: bbs_shutdown (bbs.c:646)
==197802==    by 0x11E1FA: monitor_sig_flags (bbs.c:940)
==197802==    by 0x11F054: main (bbs.c:1250)
==197802==  Address 0x5ffe242 is 210 bytes inside a block of size 218 free'd
==197802==    at 0x484417B: free (vg_replace_malloc.c:872)
==197802==    by 0x13C010: free_module (module.c:132)
==197802==    by 0x13C309: bbs_module_unregister (module.c:187)
==197802==    by 0x5A9F2F4: __unreg_module (net_ws.c:1311)
==197802==    by 0x4001129: _dl_call_fini (dl-call_fini.c:43)
==197802==    by 0x5003273: _dl_catch_exception (dl-error-skeleton.c:182)
==197802==    by 0x40017C0: _dl_close_worker (dl-close.c:253)
==197802==    by 0x4002025: _dl_close (dl-close.c:778)
==197802==    by 0x5003219: _dl_catch_exception (dl-error-skeleton.c:208)
==197802==    by 0x50032CE: _dl_catch_error (dl-error-skeleton.c:227)
==197802==    by 0x4F38FA6: _dlerror_run (dlerror.c:138)
==197802==    by 0x4F38D05: dlclose@@GLIBC_2.34 (dlclose.c:31)
==197802==  Block was alloc'd at
==197802==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==197802==    by 0x116734: __bbs_calloc (alloc.c:83)
==197802==    by 0x13CEB4: load_dlopen (module.c:380)
==197802==    by 0x13D608: load_dynamic_module (module.c:537)
==197802==    by 0x13E18F: load_resource (module.c:802)
==197802==    by 0x13F3A1: do_autoload_module (module.c:1135)
==197802==    by 0x13FBB6: try_autoload_modules (module.c:1268)
==197802==    by 0x1416E3: load_modules (module.c:1868)
==197802==    by 0x11EF74: main (bbs.c:1216)

Comments

You must be logged in to leave a comment.