buggnokii - Bugs: bug #30441, gnokii crashes trying to write...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30441: gnokii crashes trying to write phonebook to phone

Submitted by:  Alex Dusty <dusty>
Submitted on:  Wed Jul 14 10:41:21 2010  
 
Category: gnokiiSeverity: 3 - Normal
Item Group: major malfunctionStatus: Need Info
Privacy: PublicAssigned to: None
Open/Closed: Open

Tue Sep 14 18:45:07 2010, comment #3:

I just submitted a patch for the problem, I think.

I was hitting a segfault trying to upload my phonebook into my phone (Sony Ericsson). I had downloaded the phonebook previously from the phone into vcard format.

The routines for the UCS2 conversion had a trouble, trying to write 'maxlen*sizeof(wchar_t)' bytes into an output buffer that came from a pointer to an automatic wchar_t variable up in the stack.

I limited the output of the function to 1*sizeof(wchar_t) so it matches the expectations of the callers for ucs2 conversion about "one character at a time".

This did the trick to upload the phonebook, which for me was enough; I don't know if it's good enough for upstream, because I have not investigated the problem further and I know little about the purpose of all the functions in gsm-encoding.c

LluĂ­s Batlle <viric>
Sun Jul 18 08:26:40 2010, comment #2:

My goal is to copy the addressbook from a Ericsson phone. I dumped it with wammu but the .vcf file generate are incompatible with gnokii (that's saaad!). I'll try to manipulate it with a script once I'm able to make gnokii work.

I attac a complete debug session that encludes the vcard, the complete report with heap dump is available also here:
http://gnokii.pastebin.com/4tcnF3V1

Please tell me if I can be of further assistance.

-----------

GNOKII Version 0.6.29
LOG: debug mask is 0x1
Config read from file N70.gnokii.
phone instance config:
model = symbian
port = 00:1F:DE:82:4D:47
connection = bluetooth
initlength = default
serial_baudrate = 19200
serial_write_usleep = -1
handshake = software
require_dcd = 0
smsc_timeout = 10
rfcomm_channel = 14
sm_retry = 0
Serial device: opening device 00:1F:DE:82:4D:47
Channel: 14
Channel: 14
Using channel: 14
Message sent: 0x01 / 0x0002

    1. 01 |

Message received: 0x05 / 0x006a

    1. 02 00 00 00 32 00 73 00 77 00 20 00 76 00 65 | 2 s w v e
    2. 72 00 73 00 69 00 6f 00 6e 00 3a 00 0a 00 56 | r s i o n : V
    3. 20 00 35 00 2e 00 30 00 37 00 33 00 37 00 2e | 5 . 0 7 3 7 .
    4. 33 00 2e 00 30 00 2e 00 31 00 0a 00 31 00 33 | 3 . 0 . 1 1 3
    5. 2d 00 30 00 39 00 2d 00 30 00 37 00 0a 00 52 | - 0 9 - 0 7 R
    6. 4d 00 2d 00 38 00 34 00 0a 00 28 00 43 00 29 | M - 8 4 ( C )
    7. 4e 00 6f 00 6b 00 69 00 61 | N o k i a

Received message type 05
PHONE: sw version:
V 5.0737.3.0.1
13-09-07
RM-84
(C)Nokia
Unsolicited frame, skipping...
Message received: 0x01 / 0x0062

    1. 02 00 00 00 00 00 13 00 05 00 4e 00 4f 00 4b | N O K
    2. 49 00 41 00 05 00 52 00 4d 00 2d 00 38 00 34 | I A R M - 8 4
    3. 0f 00 33 00 35 00 36 00 39 00 39 00 32 00 30 | 3 5 6 9 9 2 0
    4. 31 00 39 00 30 00 35 00 31 00 39 00 38 00 34 | 1 9 0 5 1 9 8 4
    5. 0c 00 35 00 2e 00 30 00 37 00 33 00 37 00 2e | 5 . 0 7 3 7 .
    6. 33 00 2e 00 30 00 2e 00 31 00 03 00 32 00 35 | 3 . 0 . 1 2 5
    7. 36 | 6

Received message type 01
strings[0] = BEGIN:VCARD
strings[1] = VERSION:3.0
strings[2] = FN:Cognome Nome
strings[3] = N:Cognome Nome
strings[4] = TEL;TYPE=PREF,VOICE:12345
strings[5] = X-GSM-MEMORY:ME
strings[6] = X-GSM-LOCATION:198
strings[7] = X-GSM-CALLERGROUP:5
strings[8] = CATEGORIES:None
strings[9] = TEL;TYPE=CELL:12345
strings[10] = TEL;TYPE=VOICE:0039021234
strings[11] = TEL;TYPE=VOICE:001234
strings[12] = EMAIL;TYPE=INTERNET:dummy@gmail.com
strings[13] = END:VCARD
Message sent: 0x02 / 0x0008

    1. 01 00 00 00 00 00 c6 |

Message received: 0x02 / 0x0004

    1. 02 00 12 |

Received message type 02

Alex Dusty <dusty>
Thu Jul 15 09:06:37 2010, comment #1:

Can you please provide vCard file that causes the problem? It would be useful if you provide information about your locale as well. Additionally debug output might be useful.

Pawel Kot <pkot>
Project Administrator
Wed Jul 14 10:41:21 2010, original submission:

System used is kubuntu 10.04
I have a Nokia N70 phone, I installed latest gnapplet and gnokii 0.6.29.

I'm able to retrieve the phonebook but I get this error when trying to write it:

$ gnokii --writephonebook --vcard <t1.vcf
GNOKII Version 0.6.29

      • glibc detected *** gnokii: double free or corruption (out): 0x0000000000a8de50 ***

======= Backtrace: =========
/lib/libc.so.6(+0x775b6)[0x7fb119c895b6]
/lib/libc.so.6(cfree+0x73)[0x7fb119c8fe53]
/lib/libc.so.6(+0x20336)[0x7fb119c32336]
/lib/libc.so.6(iconv_close+0xf)[0x7fb119c3185f]
/usr/lib/libgnokii.so.6(+0x36569)[0x7fb11a8c6569]
/usr/lib/libgnokii.so.6(+0x36e8c)[0x7fb11a8c6e8c]
/usr/lib/libgnokii.so.6(+0x3b778)[0x7fb11a8cb778]
/usr/lib/libgnokii.so.6(+0x6d1fe)[0x7fb11a8fd1fe]
gnokii[0x40c865]
gnokii[0x404e15]
gnokii[0x4050e3]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7fb119c30c4d]
gnokii[0x403b99]
======= Memory map: ========
00400000-00421000 r-xp 00000000 08:01 248128 /usr/bin/gnokii
00621000-00622000 r--p 00021000 08:01 248128 /usr/bin/gnokii
00622000-00624000 rw-p 00022000 08:01 248128 /usr/bin/gnokii
00624000-00627000 rw-p 00000000 00:00 0
00a83000-00b2e000 rw-p 00000000 00:00 0 [heap]
7fb110000000-7fb110021000 rw-p 00000000 00:00 0
7fb110021000-7fb114000000 ---p 00000000 00:00 0
7fb117cc1000-7fb117cd7000 r-xp 00000000 08:01 326968 /lib/libgcc_s.so.1
7fb117cd7000-7fb117ed6000 ---p 00016000 08:01 326968 /lib/libgcc_s.so.1
7fb117ed6000-7fb117ed7000 r--p 00015000 08:01 326968 /lib/libgcc_s.so.1
7fb117ed7000-7fb117ed8000 rw-p 00016000 08:01 326968 /lib/libgcc_s.so.1
7fb117ed8000-7fb117f5a000 rw-p 00000000 00:00 0
7fb117f5a000-7fb117f5f000 r-xp 00000000 08:01 244853 /usr/lib/libXdmcp.so.6.0.0
7fb117f5f000-7fb11815e000 ---p 00005000 08:01 244853 /usr/lib/libXdmcp.so.6.0.0
7fb11815e000-7fb11815f000 r--p 00004000 08:01 244853 /usr/lib/libXdmcp.so.6.0.0
7fb11815f000-7fb118160000 rw-p 00005000 08:01 244853 /usr/lib/libXdmcp.so.6.0.0
7fb118160000-7fb118162000 r-xp 00000000 08:01 244796 /usr/lib/libXau.so.6.0.0
7fb118162000-7fb118362000 ---p 00002000 08:01 244796 /usr/lib/libXau.so.6.0.0
7fb118362000-7fb118363000 r--p 00002000 08:01 244796 /usr/lib/libXau.so.6.0.0
7fb118363000-7fb118364000 rw-p 00003000 08:01 244796 /usr/lib/libXau.so.6.0.0
7fb118364000-7fb118391000 r-xp 00000000 08:01 325811 /lib/libpcre.so.3.12.1
7fb118391000-7fb118590000 ---p 0002d000 08:01 325811 /lib/libpcre.so.3.12.1
7fb118590000-7fb118591000 r--p 0002c000 08:01 325811 /lib/libpcre.so.3.12.1
7fb118591000-7fb118592000 rw-p 0002d000 08:01 325811 /lib/libpcre.so.3.12.1
7fb118592000-7fb1185ad000 r-xp 00000000 08:01 245766 /usr/lib/libxcb.so.1.1.0
7fb1185ad000-7fb1187ac000 ---p 0001b000 08:01 245766 /usr/lib/libxcb.so.1.1.0
7fb1187ac000-7fb1187ad000 r--p 0001a000 08:01 245766 /usr/lib/libxcb.so.1.1.0
7fb1187ad000-7fb1187ae000 rw-p 0001b000 08:01 245766 /usr/lib/libxcb.so.1.1.0
7fb1187ae000-7fb1187b0000 r-xp 00000000 08:01 326342 /lib/libdl-2.11.1.so
7fb1187b0000-7fb1189b0000 ---p 00002000 08:01 326342 /lib/libdl-2.11.1.so
7fb1189b0000-7fb1189b1000 r--p 00002000 08:01 326342 /lib/libdl-2.11.1.so
7fb1189b1000-7fb1189b2000 rw-p 00003000 08:01 326342 /lib/libdl-2.11.1.so
7fb1189b2000-7fb118a8d000 r-xp 00000000 08:01 325848 /lib/libglib-2.0.so.0.2400.1
7fb118a8d000-7fb118c8d000 ---p 000db000 08:01 325848 /lib/libglib-2.0.so.0.2400.1
7fb118c8d000-7fb118c8e000 r--p 000db000 08:01 325848 /lib/libglib-2.0.so.0.2400.1
7fb118c8e000-7fb118c8f000 rw-p 000dc000 08:01 325848 /lib/libglib-2.0.so.0.2400.1
7fb118c8f000-7fb118c90000 rw-p 00000000 00:00 0
7fb118c90000-7fb118c97000 r-xp 00000000 08:01 326355 /lib/librt-2.11.1.so
7fb118c97000-7fb118e96000 ---p 00007000 08:01 326355 /lib/librt-2.11.1.so
7fb118e96000-7fb118e97000 r--p 00006000 08:01 326355 /lib/librt-2.11.1.so
7fb118e97000-7fb118e98000 rw-p 00007000 08:01 326355 /lib/librt-2.11.1.so
7fb118e98000-7fb118e9b000 r-xp 00000000 08:01 245955 /usr/lib/libgmodule-2.0.so.0.2400.1
7fb118e9b000-7fb11909a000 ---p 00003000 08:01 245955 /usr/lib/libgmodule-2.0.so.0.2400.1
7fb11909a000-7fb11909b000 r--p 00002000 08:01 245955 /usr/lib/libgmodule-2.0.so.0.2400.1
7fb11909b000-7fb11909c000 rw-p 00003000 08:01 245955 /usr/lib/libgmodule-2.0.so.0.2400.1
7fb11909c000-7fb1190a7000 r-xp 00000000 08:01 325831 /lib/libpcsclite.so.1.0.0
7fb1190a7000-7fb1192a6000 ---p 0000b000 08:01 325831 /lib/libpcsclite.so.1.0.0
7fb1192a6000-7fb1192a7000 r--p 0000a000 08:01 325831 /lib/libpcsclite.so.1.0.0
7fb1192a7000-7fb1192a8000 rw-p 0000b000 08:01 325831 /lib/libpcsclite.so.1.0.0
7fb1192a8000-7fb1192a9000 rw-p 00000000 00:00 0
7fb1192a9000-7fb1192b0000 r-xp 00000000 08:01 383558 /lib/libusb-0.1.so.4.4.4
7fb1192b0000-7fb1194af000 ---p 00007000 08:01 383558 /lib/libusb-0.1.so.4.4.4
7fb1194af000-7fb1194b0000 r--p 00006000 08:01 383558 /lib/libusb-0.1.so.4.4.4
7fb1194b0000-7fb1194b2000 rw-p 00007000 08:01 383558 /lib/libusb-0.1.so.4.4.4
7fb1194b2000-7fb1194c9000 r-xp 00000000 08:01 244941 /usr/lib/libbluetooth.so.3.5.0
7fb1194c9000-7fb1196c8000 ---p 00017000 08:01 244941 /usr/lib/libbluetooth.so.3.5.0
7fb1196c8000-7fb1196c9000 r--p 00016000 08:01 244941 /usr/lib/libbluetooth.so.3.5.0
7fb1196c9000-7fb1196cb000 rw-p 00017000 08:01 244941 /usr/lib/libbluetooth.so.3.5.0
7fb1196cb000-7fb1197fc000 r-xp 00000000 08:01 245834 /usr/lib/libX11.so.6.3.0
7fb1197fc000-7fb1199fc000 ---p 00131000 08:01 245834 /usr/lib/libX11.so.6.3.0
7fb1199fc000-7fb1199fd000 r--p 00131000 08:01 245834 /usr/lib/libX11.so.6.3.0Aborted

This is my config file:

[global]
port = 00:[snipped]
rfcomm_channel = 14
model = symbian
connection = bluetooth

Alex Dusty <dusty>

 

Attached Files
file #21458:  gnokii-wchar_t-trouble.patch added by viric (501B - application/octet-stream - Patch that fixes the buffer overflow)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by viric (Updated the item)
  • -unavailable- added by pkot (Posted a comment)
  • -unavailable- added by dusty (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue Sep 14 18:41:39 2010viricAttached File-=>Added gnokii-wchar_t-trouble.patch, #21458
    Thu Jul 15 09:06:53 2010pkotStatusNone=>Need Info

    Back to the top


    Powered by Savane 3.1-cleanup1