bugGPSD - Bugs: bug #46648, gpsd crashes and buffer overflow...

 
 

bug #46648: gpsd crashes and buffer overflow is reported when terminated

Submitter:  None
Submitted:  Thu 10 Dec 2015 07:14:44 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  esr
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 10 Dec 2015 07:36:55 AM UTC, comment #1: 

This seems to be related to an issue in mailing list:
Re: [gpsd-dev] gpsd doesn't terminate but crash with a SIGINT.
http://lists.nongnu.org/archive/html/gpsd-dev/2015-10/threads.html
but there a non-existing device file was given to gpsd.

I signed up for any further communication. Bug report shows me as Anonymous.

Perttu Salmela <perttusa>
Thu 10 Dec 2015 07:14:44 AM UTC, original submission:  

gpsd is started and terminated:

# ./gpsd -N -D4 /dev/ttymxc2
gpsd:INFO: launching (Version 3.15~dev)
gpsd:INFO: listening on port gpsd
gpsd:PROG: NTP: shmat(0,0,0) succeeded, segment 0
gpsd:PROG: NTP: shmat(32769,0,0) succeeded, segment 1
gpsd:PROG: NTP: shmat(65538,0,0) succeeded, segment 2
gpsd:PROG: NTP: shmat(98307,0,0) succeeded, segment 3
gpsd:PROG: NTP: shmat(131076,0,0) succeeded, segment 4
gpsd:PROG: NTP: shmat(163845,0,0) succeeded, segment 5
gpsd:PROG: NTP: shmat(196614,0,0) succeeded, segment 6
gpsd:PROG: NTP: shmat(229383,0,0) succeeded, segment 7
gpsd:PROG: successfully connected to the DBUS system bus
gpsd:PROG: shmget(0x47505344, 8928, 0666) for SHM export succeeded
gpsd:PROG: shmat() for SHM export succeeded, segment 262152
gpsd:INFO: stashing device /dev/ttymxc2 at slot 0
gpsd:INFO: running with effective group ID 0
gpsd:INFO: running with effective user ID 0
gpsd:INFO: startup at 2015-10-31T11:04:55.000Z (1446289495)
### User sends SIGINT to gpsd
*** buffer overflow detected *: ./gpsd terminated
Aborted (core dumped)

This does not happen when gpsd is started with '-n' no-wait option. If started with '-n' device is opened fine and gpsd is terminated fine.

The problem seems to be that function gpsd.c:gps_add_device sets devp->gpsdata.gps_fd = UNALLOCATED_FD (=-1) if no-wait ('-n') flag is not set. Next, in the main function around line 2166:
case AWAIT_NOT_READY:
    for (device = devices; device < devices + MAX_DEVICES; device++)
        if (allocated_device(device) && FD_ISSET(device->gpsdata.gps_fd, &efds)) {

FD_ISSET macro is called with invalid FD (-1). Adding the FD validity check before FD_ISSET fixes the crash:
   if (allocated_device(device) &&
       (0 <= device->gpsdata.gps_fd && device->gpsdata.gps_fd < FD_SETSIZE) &&
       FD_ISSET(device->gpsdata.gps_fd, &efds)) {
It is still a bit unclear for me should free_device(device) be called even if FD is invalid.

The issue occurs on embedded arm platform and may depend on implementation of FD_ISSET macro. The man page says "POSIX requires fd to be a valid file descriptor". I can see that FD_ISSET is called in couple of places elsewhere and FD validity is checked there.

The issue does not happen if client is connected. E.g. if gpspipe is run and thereafter gpsd is terminated. This is expected since in such case the FD must be valid as gpsd connects to device.

Output with proposed fix is:

# gpsd  -N  -D4 /dev/ttymxc2
gpsd:INFO: launching (Version 3.15~dev)
gpsd:INFO: listening on port gpsd
gpsd:PROG: NTP: shmat(0,0,0) succeeded, segment 0
gpsd:PROG: NTP: shmat(32769,0,0) succeeded, segment 1
gpsd:PROG: NTP: shmat(65538,0,0) succeeded, segment 2
gpsd:PROG: NTP: shmat(98307,0,0) succeeded, segment 3
gpsd:PROG: NTP: shmat(131076,0,0) succeeded, segment 4
gpsd:PROG: NTP: shmat(163845,0,0) succeeded, segment 5
gpsd:PROG: NTP: shmat(196614,0,0) succeeded, segment 6
gpsd:PROG: NTP: shmat(229383,0,0) succeeded, segment 7
gpsd:PROG: successfully connected to the DBUS system bus
gpsd:PROG: shmget(0x47505344, 8928, 0666) for SHM export succeeded
gpsd:PROG: shmat() for SHM export succeeded, segment 262152
gpsd:INFO: stashing device /dev/ttymxc2 at slot 0
gpsd:INFO: running with effective group ID 0
gpsd:INFO: running with effective user ID 0
gpsd:INFO: startup at 2015-10-31T11:31:19.000Z (1446291079)
### User sends SIGINT to gpsd
gpsd:WARN: received terminating signal 2.
gpsd:WARN: exiting.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by esr (Updated the item)
  • -email is unavailable- added by perttusa (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-09-07 esr Open/ClosedOpen Closed
    2016-01-04 esr StatusNone Fixed
        Assigned toNone esr

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code