Sun 27 Jul 2008 04:14:23 AM UTC, original submission:
How to reproduce:
1. Edit .gnokiirc as below:
2. Connect bluetooth (can browse my Nokia 6233 phone over Bluetooth from Gnome's Nautilus ok)
3. run "gnokii --identify"
4. App crashes a few seconds later
Fedora 9, fully up-to-date
Nokia 6233 over Bluetooth
gnokii-0.6.24-1.fc9.i386.rpm
[mjd@onza ~]$ grep -v '^#' .gnokiirc | grep -v '^[ ]*$'
[global]
port = 00:17:B0:B2:FD:F8
model = 6233
initlength = default
connection = bluetooth
use_locking = no
serial_baudrate = 19200
smsc_timeout = 10
[xgnokii]
allow_breakage = 0
[gnokiid]
bindir = /usr/sbin/
[connect_script]
TELEPHONE = 12345678
[disconnect_script]
[logging]
debug = on
rlpdebug = off
xdebug = off
[mjd@onza ~]$ gdb gnokii
GNU gdb Fedora (6.8-12.fc9)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
(gdb) set args --identify
(gdb) r
Starting program: /usr/bin/gnokii --identify
GNOKII Version 0.6.24
LOG: debug mask is 0x1
Config read from file /home/mjd/.gnokiirc.
phone instance config:
model = 6233
port = 00:17:B0:B2:FD:F8
connection = bluetooth
initlength = default
serial_baudrate = 19200
serial_write_usleep = -1
handshake = software
require_dcd = 0
smsc_timeout = 10
rfcomm_channel = 1
sm_retry = 0
Connecting
Serial device: opening device 00:17:B0:B2:FD:F8
Getting model...
Message sent: 0x1b / 0x0006
- 01 00 07 01 00 |
Message received: 0x1b / 0x0036
01 3b 00 08 00 01 58 30 00 29 56 20 30 34 2e 35 | ; X0 )V04.5
32 0a 30 36 2d 30 37 2d 30 36 0a 52 4d 31 32 33 | 2 06-07-06RM123
5f 31 34 35 5f 2d 0a 28 63 29 20 4e 6f 6b 69 61 | 145- (c) Nokia
0a 52 00 00 00 00 | R
Received message type 1b
model length: 11
Received model RM123_145_-
- stack smashing detected ***: /usr/bin/gnokii terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x48)[0x2b3c78]
/lib/libc.so.6(__fortify_fail+0x0)[0x2b3c30]
/usr/lib/libgnokii.so.3[0x1910d4]
/usr/lib/libgnokii.so.3[0x16b35a]
/usr/lib/libgnokii.so.3[0x16c0ee]
/usr/lib/libgnokii.so.3[0x13a1f7]
/usr/lib/libgnokii.so.3(gn_gsm_initialise+0x205)[0x13a425]
/usr/lib/libgnokii.so.3(gn_lib_phone_open+0x52)[0x139e92]
/usr/bin/gnokii[0x804a169]
/usr/bin/gnokii[0x804a439]
/usr/bin/gnokii[0x804b0ce]
/lib/libc.so.6(__libc_start_main+0xe6)[0x1d35d6]
/usr/bin/gnokii[0x8049f41]
======= Memory map: ========
00110000-0012c000 r-xp 00000000 08:05 88728 /lib/ld-2.8.so
0012c000-0012d000 r--p 0001c000 08:05 88728 /lib/ld-2.8.so
0012d000-0012e000 rw-p 0001d000 08:05 88728 /lib/ld-2.8.so
0012e000-0012f000 r-xp 0012e000 00:00 0 [vdso]
0012f000-001af000 r-xp 00000000 08:05 66939 /usr/lib/libgnokii.so.3.8.0
001af000-001b4000 rw-p 0007f000 08:05 66939 /usr/lib/libgnokii.so.3.8.0
001b4000-001bd000 rw-p 001b4000 00:00 0
001bd000-00320000 r-xp 00000000 08:05 88735 /lib/libc-2.8.so
00320000-00322000 r--p 00163000 08:05 88735 /lib/libc-2.8.so
00322000-00323000 rw-p 00165000 08:05 88735 /lib/libc-2.8.so
00323000-00326000 rw-p 00323000 00:00 0
00326000-0032d000 r-xp 00000000 08:05 65144 /usr/lib/libusb-0.1.so.4.4.4
0032d000-0032f000 rw-p 00006000 08:05 65144 /usr/lib/libusb-0.1.so.4.4.4
0032f000-00343000 r-xp 00000000 08:05 65167 /usr/lib/libbluetooth.so.2.9.6
00343000-00344000 rw-p 00014000 08:05 65167 /usr/lib/libbluetooth.so.2.9.6
00344000-00354000 r-xp 00000000 08:05 66924 /usr/lib/libXpm.so.4.11.0
00354000-00355000 rw-p 0000f000 08:05 66924 /usr/lib/libXpm.so.4.11.0
00355000-00452000 r-xp 00000000 08:05 66830 /usr/lib/libX11.so.6.2.0
00452000-00456000 rw-p 000fc000 08:05 66830 /usr/lib/libX11.so.6.2.0
00456000-00457000 r-xp 00000000 08:05 65408 /usr/lib/libxcb-xlib.so.0.0.0
00457000-00458000 rw-p 00000000 08:05 65408 /usr/lib/libxcb-xlib.so.0.0.0
00458000-00473000 r-xp 00000000 08:05 65418 /usr/lib/libxcb.so.1.0.0
00473000-00474000 rw-p 0001a000 08:05 65418 /usr/lib/libxcb.so.1.0.0
00474000-00477000 r-xp 00000000 08:05 88741 /lib/libdl-2.8.so
00477000-00478000 r--p 00002000 08:05 88741 /lib/libdl-2.8.so
00478000-00479000 rw-p 00003000 08:05 88741 /lib/libdl-2.8.so
00479000-0047b000 r-xp 00000000 08:05 65197 /usr/lib/libXau.so.6.0.0
0047b000-0047c000 rw-p 00001000 08:05 65197 /usr/lib/libXau.so.6.0.0
0047c000-00481000 r-xp 00000000 08:05 65297 /usr/lib/libXdmcp.so.6.0.0
00481000-00482000 rw-p 00004000 08:05 65297 /usr/lib/libXdmcp.so.6.0.0
00482000-0048f000 r-xp 00000000 08:05 88715 /lib/libgcc_s-4.3.0-20080428.so.1
0048f000-00490000 rw-p 0000c000 08:05 88715 /lib/libgcc_s-4.3.0-20080428.so.1
08048000-08068000 r-xp 00000000 08:05 66935 /usr/bin/gnokii
08068000-08069000 rw-p 00020000 08:05 66935 /usr/bin/gnokii
08069000-0806c000 rw-p 08069000 00:00 0
08d95000-08db6000 rw-p 08d95000 00:00 0 [heap]
b7e97000-b8097000 r--p 00000000 08:05 99740 /usr/lib/locale/locale-archive
b8097000-b809b000 rw-p b8097000 00:00 0
b80a4000-b80a5000 rw-p b80a4000 00:00 0
b80a5000-b80a6000 r--p 00b7a000 08:05 99740 /usr/lib/locale/locale-archive
bfe91000-bfea6000 rw-p bffeb000 00:00 0 [stack]
Program received signal SIGABRT, Aborted.
0x0012e416 in __kernel_vsyscall ()
Missing separate debuginfos, use: debuginfo-install gcc.i386 libXau.i386 libXdmcp.i386 libxcb.i386
(gdb) bt
#0 0x0012e416 in __kernel_vsyscall ()
#1 0x001e7660 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2 0x001e9028 in abort () at abort.c:88
#3 0x0022464d in __libc_message (do_abort=2,
fmt=0x2f6bdd "*** %s ***: %s terminated\n")
at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
#4 0x002b3c78 in __fortify_fail (msg=0x2f6bc5 "stack smashing detected")
at fortify_fail.c:32
#5 0x002b3c30 in __stack_chk_fail () at stack_chk_fail.c:29
#6 0x001910d4 in __stack_chk_fail_local () from /usr/lib/libgnokii.so.3
#7 0x0016b35a in NK6510_Initialise (state=0x8d9ac30) at nk6510.c:543
#8 0x0016c0ee in NK6510_Functions (op=GN_OP_Init, data=0x0, state=0x8d9ac30)
at nk6510.c:261
#9 0x0013a1f7 in register_driver (driver=0x1b2de0,
model=<value optimized out>, setupmodel=0x0, sm=0x8d9ac30) at gsm-api.c:115
#10 0x0013a425 in gn_gsm_initialise (sm=0x8d9ac30) at gsm-api.c:156
#11 0x00139e92 in gn_lib_phone_open (state=0x8d9ac30) at libfunctions.c:137
#12 0x0804a169 in businit () at gnokii.c:322
#13 0x0804a439 in parse_options (argc=2, argv=0xbfea54d4) at gnokii.c:768
#14 0x0804b0ce in main (argc=Cannot access memory at address 0xfbb
) at gnokii.c:1054
(gdb)
At frame 7:
#7 0x0016b35a in NK6510_Initialise (state=0x8d9ac30) at nk6510.c:543
543 }
(gdb) p *state
$1 = {current_state = GN_SM_Initialised, config = {
model = "6233", '\0' <repeats 27 times>,
irda_string = '\0' <repeats 31 times>,
port_device = "00:17:B0:B2:FD:F8", '\0' <repeats 14 times>,
connection_type = GN_CT_Bluetooth, init_length = 0,
serial_baudrate = 19200, serial_write_usleep = -1, hardware_handshake = 0,
require_dcd = 0, smsc_timeout = 100,
connect_script = '\0' <repeats 255 times>,
disconnect_script = '\0' <repeats 255 times>, rfcomm_cn = 14 '\016',
sm_retry = 0, use_locking = 0, m_model = '\0' <repeats 31 times>,
m_manufacturer = '\0' <repeats 31 times>,
m_revision = '\0' <repeats 19 times>, m_imei = '\0' <repeats 19 times>},
device = {fd = 7, type = GN_CT_Bluetooth, device_instance = 0x0}, link = {
loop = 0x18c900 <phonet_loop>,
send_message = 0x18c790 <phonet_send_message>, link_instance = 0x8d96c10,
reset = 0x18c760 <phonet_reset>}, driver = {incoming_functions = 0x1b2e40,
default_function = 0x156a20 <pgen_incoming_default>, phone = {
models = 0x1a1b7c "6510|6310|8310|6310i|6360|6610|6100|5100|3510|3510i|3595|6800|6810|6820|6820b|6610i|6230|6650|7210|7250|7250i|7600|6170|6020|6230i|5140|5140i|6021|6500|6220|3120b|3100|3120|6015i|6101|6680|6280|3220|6"...,
max_rf_level = 7, min_rf_level = 0, rf_level_unit = GN_RF_Percentage,
max_battery_level = 7, min_battery_level = 0,
battery_level_unit = GN_BU_Percentage,
---Type <return> to continue, or q <return> to quit---
datetime_support = GN_DT_DateTime, alarm_support = GN_DT_TimeOnly,
maximum_alarms_number = 1, startup_logo_height = 65,
startup_logo_width = 96, operator_logo_height = 21,
operator_logo_width = 78, caller_logo_height = 14,
caller_logo_width = 72}, functions = 0x16c050 <NK6510_Functions>,
driver_instance = 0x8d96578}, lockfile = 0x0, last_msg_type = 27 '\033',
last_msg_size = 6, last_msg = 0xbfea0118, waiting_for_number = 0 '\0',
received_number = 0 '\0', waiting_for = "\033\000", response_error = {
GN_ERR_NONE, GN_ERR_NONE, GN_ERR_NONE}, data = {0xbfea026c, 0x0, 0x0},
lasterror = GN_ERR_NONE, sm_data = {sms_folder = 0x0, sms_folder_list = 0x0,
raw_sms = 0x0, sms = 0x0, phonebook_entry = 0x0, speed_dial = 0x0,
memory_status = 0x0, message_list = {{
0x0 <repeats 24 times>} <repeats 190 times>}, sms_status = 0x0,
folder_stats = {0x0 <repeats 24 times>}, message_center = 0x0, imei = 0x0,
revision = 0x0, model = 0x0, manufacturer = 0x0, network_info = 0x0,
wap_bookmark = 0x0, wap_setting = 0x0, todo = 0x0, todo_list = 0x0,
calnote = 0x0, calnote_list = 0x0, bitmap = 0x0, ringtone = 0x0,
profile = 0x0, battery_unit = 0x0, battery_level = 0x0, rf_unit = 0x0,
rf_level = 0x0, display_output = 0x0, incoming_call_nr = 0x0,
power_source = 0x0, datetime = 0x0, alarm = 0x0, raw_data = 0x0,
call_divert = 0x0, on_sms = 0, display_status = 0x0,
on_cell_broadcast = 0, netmonitor = 0x0, call_info = 0x0,
call_notification = 0, rlp_frame = 0x0, rlp_out_dtx = 0,
---Type <return> to continue, or q <return> to quit---
rlp_rx_callback = 0, security_code = 0x0, dtmf_string = 0x0,
reset_type = 0 '\0', key_code = GN_KEY_NONE, character = 0 '\0',
phone = 0x0, locks_info = 0x0, tone = 0x0, ringtone_list = 0x0,
call_active = 0x0, file_list = 0x0, file = 0x0, callback_data = 0x0}, u = {
pb_entry = {empty = 0, name = '\0' <repeats 61 times>,
number = '\0' <repeats 49 times>, memory_type = GN_MT_ME,
caller_group = GN_PHONEBOOK_GROUP_Family, location = 0, date = {
year = 0, month = 0, day = 0, hour = 0, minute = 0, second = 0,
timezone = 0}, person = {has_person = 0,
family_name = '\0' <repeats 64 times>,
given_name = '\0' <repeats 64 times>,
additional_names = '\0' <repeats 64 times>,
honorific_prefixes = '\0' <repeats 64 times>,
honorific_suffixes = '\0' <repeats 64 times>}, address = {
has_address = 0, post_office_box = '\0' <repeats 64 times>,
extended_address = '\0' <repeats 64 times>,
street = '\0' <repeats 64 times>, city = '\0' <repeats 64 times>,
state_province = '\0' <repeats 64 times>,
zipcode = '\0' <repeats 64 times>, country = '\0' <repeats 64 times>},
subentries = {{entry_type = 0, number_type = GN_PHONEBOOK_NUMBER_None,
data = {number = '\0' <repeats 61 times>, date = {year = 0,
month = 0, day = 0, hour = 0, minute = 0, second = 0,
timezone = 0}, fileid = "\000\000\000\000\000"},
---Type <return> to continue, or q <return> to quit---
id = 0} <repeats 64 times>}, subentries_count = 0}}}
(gdb)
(Same problem happens inside of gnome-phone-manager, which also uses libgnokii)
Thank you for your help!
|