[LBBS-64] mod_operator: Crash with more than 64 options?

← All Issues || New Issue →

Sort Normal || Priority

Details

Some details missing on exactly what led up to this, but it appears to be a query where all the parameters were empty (and thus returned all the results).

The API should reject queries that do not have any filters, but the module should also truncate long responses and certainly not crash.

Failed to log 156-byte message
[2024-07-18 22:13:58.679] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.679] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.679] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.680] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.680] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.680] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.680] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.680] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.680] WARNING[3143773]: mod_ncurses.c:77 bbs_ncurses_menu_addopt: Maximum number of options (64) reached for menu
Failed to log 156-byte message
[2024-07-18 22:13:58.680]   DEBUG[3143773]: mod_ncurses.c:371 bbs_ncurses_menu_getopt: Executing menu with 64 options
Failed to log 140-byte message
[2024-07-18 22:13:58.680]   DEBUG[3143773]: term.c:116 bbs_node_set_input: Node 2 (fd 89): input now unbuffered, echo disabled
Failed to log 149-byte message
[2024-07-18 22:13:58.718]   DEBUG[3143773]: mod_ncurses.c:453 bbs_ncurses_menu_getopt: Menu return value: -1
Failed to log 131-byte message
double free or corruption (out)
Aborted (core dumped)

Thread 1 (Thread 0x7f266fe306c0 (LWP 3143773)):
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
        tid = <optimized out>
        ret = 0
        pd = <optimized out>
        old_mask = {__val = {139803916231624}}
        ret = <optimized out>
#1  0x00007f26a24a9e8f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  0x00007f26a245afb2 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
        ret = <optimized out>
#3  0x00007f26a2445472 in __GI_abort () at ./stdlib/abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, sa_mask = {__val = {5701918411760712704, 139803062625136, 139803062625136, 139803062624576, 139803785377820, 139803062624720, 5701918411760712704, 139803062624336, 139803062624808, 139803062624704, 0, 94153488384096, 23, 94153488364896, 139803908855824, 206158430256}}, sa_flags = 1877139800, sa_restorer = 0x7f266fe2e090}
#4  0x00007f26a249e430 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7f26a25b8459 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
        ap = {{gp_offset = 24, fp_offset = 21921, overflow_arg_area = 0x7f266fe2e1c0, reg_save_area = 0x7f266fe2e150}}
        fd = <optimized out>
        list = <optimized out>
        nlist = <optimized out>
        cp = <optimized out>
#5  0x00007f26a24b37aa in malloc_printerr (str=str@entry=0x7f26a25bb138 "double free or corruption (out)") at ./malloc/malloc.c:5660
#6  0x00007f26a24b5810 in _int_free (av=0x7f26a25f1c60 <main_arena>, p=0x7f26948923f0, have_lock=<optimized out>, have_lock@entry=0) at ./malloc/malloc.c:4584
        size = 139803677499280
        fb = <optimized out>
        nextchunk = 0xfe4d29124380
        nextsize = <optimized out>
        nextinuse = <optimized out>
        prevsize = <optimized out>
        bck = <optimized out>
        fwd = <optimized out>
        __PRETTY_FUNCTION__ = "_int_free"
#7  0x00007f26a24b7e8f in __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3385
        ar_ptr = <optimized out>
        p = <optimized out>
        err = 11
#8  0x00007f26a0ddf5f0 in bbs_ncurses_menu_destroy (menu=menu@entry=0x7f266fe2e930) at mod_ncurses.c:51
        i = 0
        __func__ = "bbs_ncurses_menu_destroy"
#9  0x00007f269af70918 in get_directory_location (qch=0x7f266fe2ede0) at mod_operator.c:704
        index = 0
        key = <optimized out>
        opt = <optimized out>
        value = <optimized out>
        err = {line = -1, column = -1, position = 147032, source = "<string>\000\377\377\377\000\000\000\000\000\000\000\000\377\377\377\377\377\377\377\377\000\000\000\000\000\000\000\000\377\377\377\377\000\000\000\000\320\344\342o&\177\000\000\377\377\377\377&\177\0001\340\342^\242&\177\000\000\000\000\000\000\000\000\000\000\340\342^\242", text = "\000\177\000\000\000\000\000\000\000\000\000\000;E9ѡU\000\000\350\346\342o&\177\000\000\002\000\000\000\000\000\000\000\320\344\342o&\177\000\000X\327I\242&\177\000\000\000\000\000\00044\000\000\377\001\000\000\000\000\000\000\001\200\255\373&\177\000\000\000\274AߕH!O@\347\342o&\177\000\000\000\274AߕH!O \355\342o&\177\000\000\005\000\000\000\000\000\000\000 \355\342o&\177\000\000ě8ѡU\000\000\332\002\000\000\000\000\000\000@\351\342o&\177\000\000@\347\342o&\177\000\000\020XS\242"}
        json = 0x7f26944b9450
        citystate = "X\000\000\000XX\0007\260\343\342o&\177\000\000?3142237\000\274AߕH!O"
        fullstate = "\000\351", <incomplete sequence \342>
        url = "https://REDACTED&city=X&state=&start&flexible\000\000\000e\000t=&listing=&stype=PNET_RESIDENTIAL\000uel ReyCurrently 1 call in all queues\n\000Al9ѡU\000\000("...
        res = -1
        cityid = 0
        state = <optimized out>
        fullcity = "[ ] 1560678 VN    Xóm Yân Lạc Hâu\000s\000iang\000\000\000\000\000\000\000\241U\000\000P\3468ѡU\000\000\346\3258ѡU\000\000\000\000\000\000\000\000\000\000etti]\370/\000\320\346\342o&\177\000"
        menu = {title = 0x7f266fe2e370 "KEYED:X.", subtitle = 0x0, keybindings = 0x7f266fe2e948 "ABCDEFGHIJKLMNOPQRSTUVWXYZ", ' ' <repeats 38 times>, keybind = "ABCDEFGHIJKLMNOPQRSTUVWXYZ", ' ' <repeats 38 times>, options = {0x7f2694892400 "\a", 0x7f2694892450 "[B] 584717 AZ    Xaçmaz", 0x7f2694892480 "[C] 146970 AZ    Xankandi", 0x7f26948924b0 "[D] 409421 AZ    Xankandi Sahari", 0x7f26948924e0 "[E] 147784 AZ    Xıllı", 0x7f2694892510 "[F] 147774 AZ    Xocalı", 0x7f2694892540 "[G] 148449 AZ    Xocalı Rayonu", 0x7f26941b3ee0 "[H] 584715 AZ    Xudat", 0x7f2694892570 "[I] 3384940 BR    Xambioá", 0x7f26948925a0 "[J] 3444851 BR    Xambrê", 0x7f26948925d0 "[K] 3444848 BR    Xanxerê", 0x7f2694892600 "[L] 3924674 BR    Xapuri", 0x7f2694892630 "[M] 3384937 BR    Xarqueada", 0x7f26941a7230 "[N] 3444830 BR    Xaxim", 0x7f2694892660 "[O] 3384930 BR    Xexéu", 0x7f2694892690 "[P] 3444823 BR    Xique Xique", 0x7f26948926c0 "[Q] 1529077 CN    Xahbulak", 0x7f26948926f0 "[R] 2034062 CN    Xamba", 0x7f2694892710 "[S] 8059137 CN    Xarlung", 0x7f2694892740 "[T] 1279754 CN    Xarsingma", 0x7f2694892770 "[U] 1279749 CN    Xêgar", 0x7f26948927a0 "[V] 1790807 CN    Xiabaishi", 0x7f26948927d0 "[W] 2034048 CN    Xiabancheng", 0x7f2694892800 "[X] 1910047 CN    Xiabeisi", 0x7f2694892830 "[Y] 1790796 CN    Xiabuji", 0x7f2694892860 "[Z] 1790795 CN    Xiacang", 0x7f2694892890 "[ ] 1916698 CN    Xiacaoqiao", 0x7f26948928c0 "[ ] 6422903 CN    Xiacengpu", 0x7f26948928f0 "[ ] 1919304 CN    Xiache", 0x7f2694892920 "[ ] 1790787 CN    Xiache", 0x7f2694892950 "[ ] 1790785 CN    Xiacheng", 0x7f2694892980 "[ ] 1918807 CN    Xiachengli", 0x7f26948929b0 "[ ] 1913339 CN    Xiachuan", 0x7f26948929e0 "[ ] 1790778 CN    Xiacun", 0x7f2694892a10 "[ ] 1790774 CN    Xiadao", 0x7f2694892a40 "[ ] 8201775 CN    Xiadong", 0x7f2694892a70 "[ ] 1552269 CN    Xiadu", 0x7f2694892a90 "[ ] 7643652 CN    Xiafan", 0x7f2694892ac0 "[ ] 1922425 CN    Xiafang", 0x7f2694892af0 "[ ] 1790751 CN    Xiagang", 0x7f2694892b20 "[ ] 1917891 CN    Xiage", 0x7f2694892b40 "[ ] 1790734 CN    Xiaguan", 0x7f2694892b70 "[ ] 1809239 CN    Xiagulei", 0x7f2694892ba0 "[ ] 1790719 CN    Xiahan", 0x7f2694892bd0 "[ ] 1790707 CN    Xiahu", 0x7f2694892bf0 "[ ] 1790723 CN    Xiaji", 0x7f2694892c10 "[ ] 1790696 CN    Xiajiang", 0x7f2694892c40 "[ ] 1790683 CN    Xiakeng", 0x7f2694892c70 "[ ] 1790681 CN    Xiakou", 0x7f2694892ca0 "[ ] 1790673 CN    Xiakouyi", 0x7f26944378c0 "[ ] 1790672 CN    Xialaba", 0x7f2694892cd0 "[ ] 1790665 CN    Xiali", 0x7f26944378f0 "[ ] 1790664 CN    Xialiang", 0x7f2694437920 "[ ] 7735145 CN    Xialu", 0x7f2694437940 "[ ] 1790652 CN    Xiamao", 0x7f2694437970 "[ ] 1790647 CN    Xiamayu", 0x7f26944379a0 "[ ] 7318938 CN    Xiamazhuang", 0x7f26944379d0 "[ ] 1790646 CN    Xiameicun", 0x7f2694437a00 "[ ] 1790645 CN    Xiamen", 0x7f2694437a30 "[ ] 1790637 CN    Xiamiangao", 0x7f2694437a60 "[ ] 1790636 CN    Xiamiao", 0x7f2694437a90 "[ ] 1790635 CN    Xiamujiao", 0x7f2694437ac0 "[ ] 7446847 CN    Xianan", 0x7f2694437af0 "[ ] 1919795 CN    Xiancheng"}, optvals = {0x0 <repeats 64 times>}, num_options = 64}
        city = 0x7f266fe2e340 "X"
        title = "KEYED:X.\000\0008ѡU\000\0000\345\342o&\177\000\000\002\000\000\000\000\000\000\000\260\343\342o&\177\000\000X\327I\242&\177\000\000\001\200\255\373&\177"
        c = {url = 0x7f266fe2e730 "https://REDACTED&city=X&state=&start&flexible", postfields = 0x0, ranges = 0x0, cookies = 0x0, http_code = 200, response = 0x0, forcefail = 1}
        __func__ = "get_directory_location"
        url = "https://REDACTED&city=X&state=&start&flexible\000\000\000e\000t=&listing=&stype=PNET_RESIDENTIAL\000uel ReyCurrently 1 call in all queues\n\000Al9ѡU\000\000("...
        c = {url = 0x0, postfields = 0x0, ranges = 0x0, cookies = 0x0, http_code = 0, response = 0x0, forcefail = 1}
        stype = <optimized out>
        cityid = <optimized out>
        res = <optimized out>
        outputbuf = "[ ] 1560678 VN    Xóm Yân Lạc Hâu\000s\000iang\000\000\000\000\000\000\000\241U\000\000P\3468ѡU\000\000\346\3258ѡU\000\000\000\000\000\000\000\000\000\000etti]\370/\000\320\346\342o&\177\000\000\237%\v\000\000\000\000\000@\351\342o&\177\000\000\000\000\000\000ode \320V9ѡU\000\000\000\000\000\000u\006\000\000\325@9ѡU\000\000,\000\000\000\r\000\000\000\230\223\231f\000\000\000\0002024-07-18 22:13:44\000\241U\000\0000\000\000\0000\000\000\000@\355\342o&\177\000\000@\354\342o&\177\000\000,"...
        listing = "X\000\000\000XX\0007\260\343\342o&\177\000\000?3142237\000\274AߕH!O@\351\342o&\177\000\000@\351\342o&\177\000"
        title = "KEYED:X.\000\0008ѡU\000\0000\345\342o&\177\000\000\002\000\000\000\000\000\000\000\260\343\342o&\177\000\000X\327I\242&\177\000\000\001\200\255\373&\177"
        menu = {title = 0x7f266fe2e370 "KEYED:X.", subtitle = 0x0, keybindings = 0x7f266fe2e948 "ABCDEFGHIJKLMNOPQRSTUVWXYZ", ' ' <repeats 38 times>, keybind = "ABCDEFGHIJKLMNOPQRSTUVWXYZ", ' ' <repeats 38 times>, options = {0x7f2694892400 "\a", 0x7f2694892450 "[B] 584717 AZ    Xaçmaz", 0x7f2694892480 "[C] 146970 AZ    Xankandi", 0x7f26948924b0 "[D] 409421 AZ    Xankandi Sahari", 0x7f26948924e0 "[E] 147784 AZ    Xıllı", 0x7f2694892510 "[F] 147774 AZ    Xocalı", 0x7f2694892540 "[G] 148449 AZ    Xocalı Rayonu", 0x7f26941b3ee0 "[H] 584715 AZ    Xudat", 0x7f2694892570 "[I] 3384940 BR    Xambioá", 0x7f26948925a0 "[J] 3444851 BR    Xambrê", 0x7f26948925d0 "[K] 3444848 BR    Xanxerê", 0x7f2694892600 "[L] 3924674 BR    Xapuri", 0x7f2694892630 "[M] 3384937 BR    Xarqueada", 0x7f26941a7230 "[N] 3444830 BR    Xaxim", 0x7f2694892660 "[O] 3384930 BR    Xexéu", 0x7f2694892690 "[P] 3444823 BR    Xique Xique", 0x7f26948926c0 "[Q] 1529077 CN    Xahbulak", 0x7f26948926f0 "[R] 2034062 CN    Xamba", 0x7f2694892710 "[S] 8059137 CN    Xarlung", 0x7f2694892740 "[T] 1279754 CN    Xarsingma", 0x7f2694892770 "[U] 1279749 CN    Xêgar", 0x7f26948927a0 "[V] 1790807 CN    Xiabaishi", 0x7f26948927d0 "[W] 2034048 CN    Xiabancheng", 0x7f2694892800 "[X] 1910047 CN    Xiabeisi", 0x7f2694892830 "[Y] 1790796 CN    Xiabuji", 0x7f2694892860 "[Z] 1790795 CN    Xiacang", 0x7f2694892890 "[ ] 1916698 CN    Xiacaoqiao", 0x7f26948928c0 "[ ] 6422903 CN    Xiacengpu", 0x7f26948928f0 "[ ] 1919304 CN    Xiache", 0x7f2694892920 "[ ] 1790787 CN    Xiache", 0x7f2694892950 "[ ] 1790785 CN    Xiacheng", 0x7f2694892980 "[ ] 1918807 CN    Xiachengli", 0x7f26948929b0 "[ ] 1913339 CN    Xiachuan", 0x7f26948929e0 "[ ] 1790778 CN    Xiacun", 0x7f2694892a10 "[ ] 1790774 CN    Xiadao", 0x7f2694892a40 "[ ] 8201775 CN    Xiadong", 0x7f2694892a70 "[ ] 1552269 CN    Xiadu", 0x7f2694892a90 "[ ] 7643652 CN    Xiafan", 0x7f2694892ac0 "[ ] 1922425 CN    Xiafang", 0x7f2694892af0 "[ ] 1790751 CN    Xiagang", 0x7f2694892b20 "[ ] 1917891 CN    Xiage", 0x7f2694892b40 "[ ] 1790734 CN    Xiaguan", 0x7f2694892b70 "[ ] 1809239 CN    Xiagulei", 0x7f2694892ba0 "[ ] 1790719 CN    Xiahan", 0x7f2694892bd0 "[ ] 1790707 CN    Xiahu", 0x7f2694892bf0 "[ ] 1790723 CN    Xiaji", 0x7f2694892c10 "[ ] 1790696 CN    Xiajiang", 0x7f2694892c40 "[ ] 1790683 CN    Xiakeng", 0x7f2694892c70 "[ ] 1790681 CN    Xiakou", 0x7f2694892ca0 "[ ] 1790673 CN    Xiakouyi", 0x7f26944378c0 "[ ] 1790672 CN    Xialaba", 0x7f2694892cd0 "[ ] 1790665 CN    Xiali", 0x7f26944378f0 "[ ] 1790664 CN    Xialiang", 0x7f2694437920 "[ ] 7735145 CN    Xialu", 0x7f2694437940 "[ ] 1790652 CN    Xiamao", 0x7f2694437970 "[ ] 1790647 CN    Xiamayu", 0x7f26944379a0 "[ ] 7318938 CN    Xiamazhuang", 0x7f26944379d0 "[ ] 1790646 CN    Xiameicun", 0x7f2694437a00 "[ ] 1790645 CN    Xiamen", 0x7f2694437a30 "[ ] 1790637 CN    Xiamiangao", 0x7f2694437a60 "[ ] 1790636 CN    Xiamiao", 0x7f2694437a90 "[ ] 1790635 CN    Xiamujiao", 0x7f2694437ac0 "[ ] 7446847 CN    Xianan", 0x7f2694437af0 "[ ] 1919795 CN    Xiancheng"}, optvals = {0x0 <repeats 64 times>}, num_options = 64}
        agentchan = "IAX2/79.116.144.108:4569-14007", '\000' <repeats 225 times>
        __func__ = "handle_directory"

Comments

You must be logged in to leave a comment.