buggnokii - Bugs: bug #30441, gnokii crashes trying to write...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30441: gnokii crashes trying to write phonebook to phone

Submitter:  Alex Dusty <dusty>
Submitted:  Wed 14 Jul 2010 10:41:21 AM UTC
   
 
Category:  gnokii Severity:  3 - Normal
Item Group:  major malfunction Status:  Need Info
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Tue 14 Sep 2010 06:45:07 PM UTC, comment #3: 

I just submitted a patch for the problem, I think.

I was hitting a segfault trying to upload my phonebook into my phone (Sony Ericsson). I had downloaded the phonebook previously from the phone into vcard format.

The routines for the UCS2 conversion had a trouble, trying to write 'maxlen*sizeof(wchar_t)' bytes into an output buffer that came from a pointer to an automatic wchar_t variable up in the stack.

I limited the output of the function to 1*sizeof(wchar_t) so it matches the expectations of the callers for ucs2 conversion about "one character at a time".

This did the trick to upload the phonebook, which for me was enough; I don't know if it's good enough for upstream, because I have not investigated the problem further and I know little about the purpose of all the functions in gsm-encoding.c

 Lluís Batlle <viric>
Sun 18 Jul 2010 08:26:40 AM UTC, comment #2: 

My goal is to copy the addressbook from a Ericsson phone. I dumped it with wammu but the .vcf file generate are incompatible with gnokii (that's saaad!). I'll try to manipulate it with a script once I'm able to make gnokii work.

I attac a complete debug session that encludes the vcard, the complete report with heap dump is available also here:
http://gnokii.pastebin.com/4tcnF3V1

Please tell me if I can be of further assistance.

-----------

GNOKII Version 0.6.29
LOG: debug mask is 0x1
Config read from file N70.gnokii.
phone instance config:
model = symbian
port = 00:1F:DE:82:4D:47
connection = bluetooth
initlength = default
serial_baudrate = 19200
serial_write_usleep = -1
handshake = software
require_dcd = 0
smsc_timeout = 10
rfcomm_channel = 14
sm_retry = 0
Serial device: opening device 00:1F:DE:82:4D:47
Channel: 14
Channel: 14
Using channel: 14
Message sent: 0x01 / 0x0002
00 01                                           |                
Message received: 0x05 / 0x006a
00 02 00 00 00 32 00 73 00 77 00 20 00 76 00 65 |      2 s w   v e
00 72 00 73 00 69 00 6f 00 6e 00 3a 00 0a 00 56 |  r s i o n :   V
00 20 00 35 00 2e 00 30 00 37 00 33 00 37 00 2e |    5 . 0 7 3 7 .
00 33 00 2e 00 30 00 2e 00 31 00 0a 00 31 00 33 |  3 . 0 . 1   1 3
00 2d 00 30 00 39 00 2d 00 30 00 37 00 0a 00 52 |  - 0 9 - 0 7   R
00 4d 00 2d 00 38 00 34 00 0a 00 28 00 43 00 29 |  M - 8 4   ( C )
00 4e 00 6f 00 6b 00 69 00 61                   |  N o k i a     
Received message type 05
PHONE: sw version:
V 5.0737.3.0.1
13-09-07
RM-84
(C)Nokia
Unsolicited frame, skipping...
Message received: 0x01 / 0x0062
00 02 00 00 00 00 00 13 00 05 00 4e 00 4f 00 4b |            N O K
00 49 00 41 00 05 00 52 00 4d 00 2d 00 38 00 34 |  I A   R M - 8 4
00 0f 00 33 00 35 00 36 00 39 00 39 00 32 00 30 |    3 5 6 9 9 2 0
00 31 00 39 00 30 00 35 00 31 00 39 00 38 00 34 |  1 9 0 5 1 9 8 4
00 0c 00 35 00 2e 00 30 00 37 00 33 00 37 00 2e |    5 . 0 7 3 7 .
00 33 00 2e 00 30 00 2e 00 31 00 03 00 32 00 35 |  3 . 0 . 1   2 5
00 36                                           |  6             
Received message type 01
strings[0] = BEGIN:VCARD
strings[1] = VERSION:3.0
strings[2] = FN:Cognome Nome
strings[3] = N:Cognome Nome
strings[4] = TEL;TYPE=PREF,VOICE:12345
strings[5] = X-GSM-MEMORY:ME
strings[6] = X-GSM-LOCATION:198
strings[7] = X-GSM-CALLERGROUP:5
strings[8] = CATEGORIES:None
strings[9] = TEL;TYPE=CELL:12345
strings[10] = TEL;TYPE=VOICE:0039021234
strings[11] = TEL;TYPE=VOICE:001234
strings[12] = EMAIL;TYPE=INTERNET:dummy@gmail.com
strings[13] = END:VCARD
Message sent: 0x02 / 0x0008
00 01 00 00 00 00 00 c6                         |                
Message received: 0x02 / 0x0004
00 02 00 12                                     |                
Received message type 02

Alex Dusty <dusty>
Thu 15 Jul 2010 09:06:37 AM UTC, comment #1: 

Can you please provide vCard file that causes the problem? It would be useful if you provide information about your locale as well. Additionally debug output might be useful.

 Pawel Kot <pkot>
Group administrator
Wed 14 Jul 2010 10:41:21 AM UTC, original submission:  

System used is kubuntu 10.04
I have a Nokia N70 phone, I installed latest gnapplet and gnokii 0.6.29.

I'm able to retrieve the phonebook but I get this error when trying to write it:

$ gnokii --writephonebook --vcard <t1.vcf
GNOKII Version 0.6.29
* glibc detected * gnokii: double free or corruption (out): 0x0000000000a8de50 *
======= Backtrace: =========
/lib/libc.so.6(+0x775b6)[0x7fb119c895b6]
/lib/libc.so.6(cfree+0x73)[0x7fb119c8fe53]
/lib/libc.so.6(+0x20336)[0x7fb119c32336]
/lib/libc.so.6(iconv_close+0xf)[0x7fb119c3185f]
/usr/lib/libgnokii.so.6(+0x36569)[0x7fb11a8c6569]
/usr/lib/libgnokii.so.6(+0x36e8c)[0x7fb11a8c6e8c]
/usr/lib/libgnokii.so.6(+0x3b778)[0x7fb11a8cb778]
/usr/lib/libgnokii.so.6(+0x6d1fe)[0x7fb11a8fd1fe]
gnokii[0x40c865]
gnokii[0x404e15]
gnokii[0x4050e3]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7fb119c30c4d]
gnokii[0x403b99]
======= Memory map: ========
00400000-00421000 r-xp 00000000 08:01 248128                             /usr/bin/gnokii
00621000-00622000 r--p 00021000 08:01 248128                             /usr/bin/gnokii
00622000-00624000 rw-p 00022000 08:01 248128                             /usr/bin/gnokii
00624000-00627000 rw-p 00000000 00:00 0
00a83000-00b2e000 rw-p 00000000 00:00 0                                  [heap]
7fb110000000-7fb110021000 rw-p 00000000 00:00 0
7fb110021000-7fb114000000 ---p 00000000 00:00 0
7fb117cc1000-7fb117cd7000 r-xp 00000000 08:01 326968                     /lib/libgcc_s.so.1
7fb117cd7000-7fb117ed6000 ---p 00016000 08:01 326968                     /lib/libgcc_s.so.1
7fb117ed6000-7fb117ed7000 r--p 00015000 08:01 326968                     /lib/libgcc_s.so.1
7fb117ed7000-7fb117ed8000 rw-p 00016000 08:01 326968                     /lib/libgcc_s.so.1
7fb117ed8000-7fb117f5a000 rw-p 00000000 00:00 0
7fb117f5a000-7fb117f5f000 r-xp 00000000 08:01 244853                     /usr/lib/libXdmcp.so.6.0.0
7fb117f5f000-7fb11815e000 ---p 00005000 08:01 244853                     /usr/lib/libXdmcp.so.6.0.0
7fb11815e000-7fb11815f000 r--p 00004000 08:01 244853                     /usr/lib/libXdmcp.so.6.0.0
7fb11815f000-7fb118160000 rw-p 00005000 08:01 244853                     /usr/lib/libXdmcp.so.6.0.0
7fb118160000-7fb118162000 r-xp 00000000 08:01 244796                     /usr/lib/libXau.so.6.0.0
7fb118162000-7fb118362000 ---p 00002000 08:01 244796                     /usr/lib/libXau.so.6.0.0
7fb118362000-7fb118363000 r--p 00002000 08:01 244796                     /usr/lib/libXau.so.6.0.0
7fb118363000-7fb118364000 rw-p 00003000 08:01 244796                     /usr/lib/libXau.so.6.0.0
7fb118364000-7fb118391000 r-xp 00000000 08:01 325811                     /lib/libpcre.so.3.12.1
7fb118391000-7fb118590000 ---p 0002d000 08:01 325811                     /lib/libpcre.so.3.12.1
7fb118590000-7fb118591000 r--p 0002c000 08:01 325811                     /lib/libpcre.so.3.12.1
7fb118591000-7fb118592000 rw-p 0002d000 08:01 325811                     /lib/libpcre.so.3.12.1
7fb118592000-7fb1185ad000 r-xp 00000000 08:01 245766                     /usr/lib/libxcb.so.1.1.0
7fb1185ad000-7fb1187ac000 ---p 0001b000 08:01 245766                     /usr/lib/libxcb.so.1.1.0
7fb1187ac000-7fb1187ad000 r--p 0001a000 08:01 245766                     /usr/lib/libxcb.so.1.1.0
7fb1187ad000-7fb1187ae000 rw-p 0001b000 08:01 245766                     /usr/lib/libxcb.so.1.1.0
7fb1187ae000-7fb1187b0000 r-xp 00000000 08:01 326342                     /lib/libdl-2.11.1.so
7fb1187b0000-7fb1189b0000 ---p 00002000 08:01 326342                     /lib/libdl-2.11.1.so
7fb1189b0000-7fb1189b1000 r--p 00002000 08:01 326342                     /lib/libdl-2.11.1.so
7fb1189b1000-7fb1189b2000 rw-p 00003000 08:01 326342                     /lib/libdl-2.11.1.so
7fb1189b2000-7fb118a8d000 r-xp 00000000 08:01 325848                     /lib/libglib-2.0.so.0.2400.1
7fb118a8d000-7fb118c8d000 ---p 000db000 08:01 325848                     /lib/libglib-2.0.so.0.2400.1
7fb118c8d000-7fb118c8e000 r--p 000db000 08:01 325848                     /lib/libglib-2.0.so.0.2400.1
7fb118c8e000-7fb118c8f000 rw-p 000dc000 08:01 325848                     /lib/libglib-2.0.so.0.2400.1
7fb118c8f000-7fb118c90000 rw-p 00000000 00:00 0
7fb118c90000-7fb118c97000 r-xp 00000000 08:01 326355                     /lib/librt-2.11.1.so
7fb118c97000-7fb118e96000 ---p 00007000 08:01 326355                     /lib/librt-2.11.1.so
7fb118e96000-7fb118e97000 r--p 00006000 08:01 326355                     /lib/librt-2.11.1.so
7fb118e97000-7fb118e98000 rw-p 00007000 08:01 326355                     /lib/librt-2.11.1.so
7fb118e98000-7fb118e9b000 r-xp 00000000 08:01 245955                     /usr/lib/libgmodule-2.0.so.0.2400.1
7fb118e9b000-7fb11909a000 ---p 00003000 08:01 245955                     /usr/lib/libgmodule-2.0.so.0.2400.1
7fb11909a000-7fb11909b000 r--p 00002000 08:01 245955                     /usr/lib/libgmodule-2.0.so.0.2400.1
7fb11909b000-7fb11909c000 rw-p 00003000 08:01 245955                     /usr/lib/libgmodule-2.0.so.0.2400.1
7fb11909c000-7fb1190a7000 r-xp 00000000 08:01 325831                     /lib/libpcsclite.so.1.0.0
7fb1190a7000-7fb1192a6000 ---p 0000b000 08:01 325831                     /lib/libpcsclite.so.1.0.0
7fb1192a6000-7fb1192a7000 r--p 0000a000 08:01 325831                     /lib/libpcsclite.so.1.0.0
7fb1192a7000-7fb1192a8000 rw-p 0000b000 08:01 325831                     /lib/libpcsclite.so.1.0.0
7fb1192a8000-7fb1192a9000 rw-p 00000000 00:00 0
7fb1192a9000-7fb1192b0000 r-xp 00000000 08:01 383558                     /lib/libusb-0.1.so.4.4.4
7fb1192b0000-7fb1194af000 ---p 00007000 08:01 383558                     /lib/libusb-0.1.so.4.4.4
7fb1194af000-7fb1194b0000 r--p 00006000 08:01 383558                     /lib/libusb-0.1.so.4.4.4
7fb1194b0000-7fb1194b2000 rw-p 00007000 08:01 383558                     /lib/libusb-0.1.so.4.4.4
7fb1194b2000-7fb1194c9000 r-xp 00000000 08:01 244941                     /usr/lib/libbluetooth.so.3.5.0
7fb1194c9000-7fb1196c8000 ---p 00017000 08:01 244941                     /usr/lib/libbluetooth.so.3.5.0
7fb1196c8000-7fb1196c9000 r--p 00016000 08:01 244941                     /usr/lib/libbluetooth.so.3.5.0
7fb1196c9000-7fb1196cb000 rw-p 00017000 08:01 244941                     /usr/lib/libbluetooth.so.3.5.0
7fb1196cb000-7fb1197fc000 r-xp 00000000 08:01 245834                     /usr/lib/libX11.so.6.3.0
7fb1197fc000-7fb1199fc000 ---p 00131000 08:01 245834                     /usr/lib/libX11.so.6.3.0
7fb1199fc000-7fb1199fd000 r--p 00131000 08:01 245834                     /usr/lib/libX11.so.6.3.0Aborted

This is my config file:

[global]
port = 00:[snipped]
rfcomm_channel = 14
model = symbian
connection = bluetooth

Alex Dusty <dusty>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #21458:  gnokii-wchar_t-trouble.patch added by viric (501B - application/octet-stream - Patch that fixes the buffer overflow)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by viric (Updated the item)
  • -email is unavailable- added by pkot (Posted a comment)
  • -email is unavailable- added by dusty (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-09-14 viric Attached File- Added gnokii-wchar_t-trouble.patch, #21458
    2010-07-15 pkot StatusNone Need Info

    Back to the top

    Copyright © 2025 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-04e1.
    Corresponding source code