Subject: Re: gzip buffer overflow found
To: None <current-users@netbsd.org>
From: Geoff Wing <mason@primenet.com.au>
List: current-users
Date: 01/19/2001 04:32:48
Jeremy C. Reed <reed@reedmedia.net> typed:
:On Fri, 19 Jan 2001, Simon Burge wrote:
:> When debugging with gdb it's useful to build debugging versions of
:> the programs. On my main development machine, I have in /etc/mk.conf:
:> COPTS+= -g
:> LDFLAGS+= -g
:> so all programs and libraries get built with debugging information.
:Okay. I did this.
:telnet says:
:#0 0x482032a6 in strcpy ()
:#1 0x805a6a0 in _hostname ()
:#2 0x804da2c in main (argc=2, argv=0xbfbe556c) at main.c:356
:#3 0x804a2e5 in ___start ()
:But how can I easily find line "356" with all the #ifdef's and macros?
:(Is there some tool for that?)
:After testing further, it appears that the bad strcpy is really line 2434
:in commands.c. I wonder why the backtrace says the other one.
Line 356 is absolute. Either use an editor or go "up" the stack and
list it. tn() is a valid function. Looks like the stack is being
hosed. And, yes, at commands.c:2434
(gdb) up
#1 0x805a720 in _hostname ()
(gdb) up
#2 0x804da8c in main (argc=2, argv=0xbfbe514c) at main.c:356
356 if (tn(argp - args, args) == 1)
(gdb) l
351 *argp++ = argv[1]; /* port */
352 *argp = 0;
353
354 if (setjmp(toplevel) != 0)
355 Exit(0);
356 if (tn(argp - args, args) == 1)
357 return (0);
358 else
359 return (1);
360 }
(gdb) l tn
2367
2368 int
2369 tn(argc, argv)
2370 int argc;
2371 char *argv[];
2372 {
2373 struct addrinfo hints, *res, *res0;
2374 char *cause = "telnet: unknown";
2375 int error;
2376 #if defined(IP_OPTIONS) && defined(IPPROTO_IP)
(gdb)
Regards,
--
Geoff Wing : <gcw@pobox.com>
Rxvt Stuff : <gcw@rxvt.org>
Zsh Stuff : <gcw@zsh.org>