bugGPSD - Bugs: bug #46648, gpsd crashes and buffer overflow...

 
 

bug #46648: gpsd crashes and buffer overflow is reported when terminated

Submitted by:  None
Submitted on:  Thu 10 Dec 2015 07:14:44 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Eric S. Raymond <esr>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 10 Dec 2015 07:36:55 AM UTC, comment #1:

This seems to be related to an issue in mailing list:
Re: [gpsd-dev] gpsd doesn't terminate but crash with a SIGINT.
http://lists.nongnu.org/archive/html/gpsd-dev/2015-10/threads.html
but there a non-existing device file was given to gpsd.

I signed up for any further communication. Bug report shows me as Anonymous.

Perttu Salmela <perttusa>
Thu 10 Dec 2015 07:14:44 AM UTC, original submission:

gpsd is started and terminated:

# ./gpsd -N -D4 /dev/ttymxc2
gpsd:INFO: launching (Version 3.15~dev)
gpsd:INFO: listening on port gpsd
gpsd:PROG: NTP: shmat(0,0,0) succeeded, segment 0
gpsd:PROG: NTP: shmat(32769,0,0) succeeded, segment 1
gpsd:PROG: NTP: shmat(65538,0,0) succeeded, segment 2
gpsd:PROG: NTP: shmat(98307,0,0) succeeded, segment 3
gpsd:PROG: NTP: shmat(131076,0,0) succeeded, segment 4
gpsd:PROG: NTP: shmat(163845,0,0) succeeded, segment 5
gpsd:PROG: NTP: shmat(196614,0,0) succeeded, segment 6
gpsd:PROG: NTP: shmat(229383,0,0) succeeded, segment 7
gpsd:PROG: successfully connected to the DBUS system bus
gpsd:PROG: shmget(0x47505344, 8928, 0666) for SHM export succeeded
gpsd:PROG: shmat() for SHM export succeeded, segment 262152
gpsd:INFO: stashing device /dev/ttymxc2 at slot 0
gpsd:INFO: running with effective group ID 0
gpsd:INFO: running with effective user ID 0
gpsd:INFO: startup at 2015-10-31T11:04:55.000Z (1446289495)
### User sends SIGINT to gpsd
*** buffer overflow detected ***: ./gpsd terminated
Aborted (core dumped)

This does not happen when gpsd is started with '-n' no-wait option. If started with '-n' device is opened fine and gpsd is terminated fine.

The problem seems to be that function gpsd.c:gps_add_device sets devp->gpsdata.gps_fd = UNALLOCATED_FD (=-1) if no-wait ('-n') flag is not set. Next, in the main function around line 2166:
case AWAIT_NOT_READY:
for (device = devices; device < devices + MAX_DEVICES; device++)
if (allocated_device(device) && FD_ISSET(device->gpsdata.gps_fd, &efds)) {

FD_ISSET macro is called with invalid FD (-1). Adding the FD validity check before FD_ISSET fixes the crash:
if (allocated_device(device) &&
(0 <= device->gpsdata.gps_fd && device->gpsdata.gps_fd < FD_SETSIZE) &&
FD_ISSET(device->gpsdata.gps_fd, &efds)) {
It is still a bit unclear for me should free_device(device) be called even if FD is invalid.

The issue occurs on embedded arm platform and may depend on implementation of FD_ISSET macro. The man page says "POSIX requires fd to be a valid file descriptor". I can see that FD_ISSET is called in couple of places elsewhere and FD validity is checked there.

The issue does not happen if client is connected. E.g. if gpspipe is run and thereafter gpsd is terminated. This is expected since in such case the FD must be valid as gpsd connects to device.

Output with proposed fix is:

# gpsd -N -D4 /dev/ttymxc2
gpsd:INFO: launching (Version 3.15~dev)
gpsd:INFO: listening on port gpsd
gpsd:PROG: NTP: shmat(0,0,0) succeeded, segment 0
gpsd:PROG: NTP: shmat(32769,0,0) succeeded, segment 1
gpsd:PROG: NTP: shmat(65538,0,0) succeeded, segment 2
gpsd:PROG: NTP: shmat(98307,0,0) succeeded, segment 3
gpsd:PROG: NTP: shmat(131076,0,0) succeeded, segment 4
gpsd:PROG: NTP: shmat(163845,0,0) succeeded, segment 5
gpsd:PROG: NTP: shmat(196614,0,0) succeeded, segment 6
gpsd:PROG: NTP: shmat(229383,0,0) succeeded, segment 7
gpsd:PROG: successfully connected to the DBUS system bus
gpsd:PROG: shmget(0x47505344, 8928, 0666) for SHM export succeeded
gpsd:PROG: shmat() for SHM export succeeded, segment 262152
gpsd:INFO: stashing device /dev/ttymxc2 at slot 0
gpsd:INFO: running with effective group ID 0
gpsd:INFO: running with effective user ID 0
gpsd:INFO: startup at 2015-10-31T11:31:19.000Z (1446291079)
### User sends SIGINT to gpsd
gpsd:WARN: received terminating signal 2.
gpsd:WARN: exiting.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by esr (Updated the item)
  • -unavailable- added by perttusa (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 07 Sep 2017 04:35:35 AM UTCesrOpen/ClosedOpen=>Closed
    Mon 04 Jan 2016 08:28:34 PM UTCesrStatusNone=>Fixed
      Assigned toNone=>esr

    Back to the top


    Powered by Savane 3.1-cleanup1