full backtrace

adesklets-fortify.txt (text/plain), 17.41 KB, created by Peter Volkov (RETIRED) on 2009-09-08 11:11:52 UTC

*** buffer overflow detected ***: adesklets terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x37)[0x7f03c3ff04e7]
/lib/libc.so.6[0x7f03c3fee320]
/lib/libc.so.6[0x7f03c3fed8db]
adesklets[0x413d32]
adesklets[0x407caa]
adesklets[0x4065c5]
/lib/libc.so.6(__libc_start_main+0xe6)[0x7f03c3f2ba26]
adesklets(rl_filename_completion_function+0x611)[0x4064a9]
======= Memory map: ========
00400000-0041e000 r-xp 00000000 08:02 513501                             /usr/bin/adesklets
0061d000-0061e000 r--p 0001d000 08:02 513501                             /usr/bin/adesklets
0061e000-0061f000 rw-p 0001e000 08:02 513501                             /usr/bin/adesklets
0061f000-00620000 rw-p 00000000 00:00 0 
01d66000-01e64000 rw-p 00000000 00:00 0                                  [heap]
7f03bf0d3000-7f03bf0e9000 r-xp 00000000 08:02 141849                     /lib64/libgcc_s.so.1
7f03bf0e9000-7f03bf2e8000 ---p 00016000 08:02 141849                     /lib64/libgcc_s.so.1
7f03bf2e8000-7f03bf2e9000 r--p 00015000 08:02 141849                     /lib64/libgcc_s.so.1
7f03bf2e9000-7f03bf2ea000 rw-p 00016000 08:02 141849                     /lib64/libgcc_s.so.1
7f03bf2ea000-7f03bf2eb000 r-xp 00000000 08:02 570064                     /usr/lib64/imlib2/loaders/argb.so
7f03bf2eb000-7f03bf4eb000 ---p 00001000 08:02 570064                     /usr/lib64/imlib2/loaders/argb.so
7f03bf4eb000-7f03bf4ec000 r--p 00001000 08:02 570064                     /usr/lib64/imlib2/loaders/argb.so
7f03bf4ec000-7f03bf4ed000 rw-p 00002000 08:02 570064                     /usr/lib64/imlib2/loaders/argb.so
7f03bf4ed000-7f03bf4f0000 r-xp 00000000 08:02 570054                     /usr/lib64/imlib2/loaders/bmp.so
7f03bf4f0000-7f03bf6ef000 ---p 00003000 08:02 570054                     /usr/lib64/imlib2/loaders/bmp.so
7f03bf6ef000-7f03bf6f0000 r--p 00002000 08:02 570054                     /usr/lib64/imlib2/loaders/bmp.so
7f03bf6f0000-7f03bf6f1000 rw-p 00003000 08:02 570054                     /usr/lib64/imlib2/loaders/bmp.so
7f03bf6f1000-7f03bf700000 r-xp 00000000 08:02 130113                     /lib64/libbz2.so.1.0.5
7f03bf700000-7f03bf8ff000 ---p 0000f000 08:02 130113                     /lib64/libbz2.so.1.0.5
7f03bf8ff000-7f03bf900000 r--p 0000e000 08:02 130113                     /lib64/libbz2.so.1.0.5
7f03bf900000-7f03bf901000 rw-p 0000f000 08:02 130113                     /lib64/libbz2.so.1.0.5
7f03bf901000-7f03bf903000 r-xp 00000000 08:02 570043                     /usr/lib64/imlib2/loaders/bz2.so
7f03bf903000-7f03bfb02000 ---p 00002000 08:02 570043                     /usr/lib64/imlib2/loaders/bz2.so
7f03bfb02000-7f03bfb03000 r--p 00001000 08:02 570043                     /usr/lib64/imlib2/loaders/bz2.so
7f03bfb03000-7f03bfb04000 rw-p 00002000 08:02 570043                     /usr/lib64/imlib2/loaders/bz2.so
7f03bfb04000-7f03bfb0c000 r-xp 00000000 08:02 503897                     /usr/lib64/libgif.so.4.1.6
7f03bfb0c000-7f03bfd0b000 ---p 00008000 08:02 503897                     /usr/lib64/libgif.so.4.1.6
7f03bfd0b000-7f03bfd0c000 r--p 00007000 08:02 503897                     /usr/lib64/libgif.so.4.1.6
7f03bfd0c000-7f03bfd0d000 rw-p 00008000 08:02 503897                     /usr/lib64/libgif.so.4.1.6
7f03bfd0d000-7f03bfd0f000 r-xp 00000000 08:02 570042                     /usr/lib64/imlib2/loaders/gif.so
7f03bfd0f000-7f03bff0e000 ---p 00002000 08:02 570042                     /usr/lib64/imlib2/loaders/gif.so
7f03bff0e000-7f03bff0f000 r--p 00001000 08:02 570042                     /usr/lib64/imlib2/loaders/gif.so
7f03bff0f000-7f03bff10000 rw-p 00002000 08:02 570042                     /usr/lib64/imlib2/loaders/gif.so
7f03bff10000-7f03bff23000 r-xp 00000000 08:02 502114                     /usr/lib64/libid3tag.so.0.3.0
7f03bff23000-7f03c0123000 ---p 00013000 08:02 502114                     /usr/lib64/libid3tag.so.0.3.0
7f03c0123000-7f03c0125000 r--p 00013000 08:02 502114                     /usr/lib64/libid3tag.so.0.3.0
7f03c0125000-7f03c0126000 rw-p 00015000 08:02 502114                     /usr/lib64/libid3tag.so.0.3.0
7f03c0126000-7f03c0129000 r-xp 00000000 08:02 570062                     /usr/lib64/imlib2/loaders/id3.so
7f03c0129000-7f03c0328000 ---p 00003000 08:02 570062                     /usr/lib64/imlib2/loaders/id3.so
7f03c0328000-7f03c0329000 r--p 00002000 08:02 570062                     /usr/lib64/imlib2/loaders/id3.so
7f03c0329000-7f03c032a000 rw-p 00003000 08:02 570062                     /usr/lib64/imlib2/loaders/id3.so
7f03c032a000-7f03c032c000 r-xp 00000000 08:02 570036                     /usr/lib64/imlib2/loaders/jpeg.so
7f03c032c000-7f03c052b000 ---p 00002000 08:02 570036                     /usr/lib64/imlib2/loaders/jpeg.so
7f03c052b000-7f03c052c000 r--p 00001000 08:02 570036                     /usr/lib64/imlib2/loaders/jpeg.so
7f03c052c000-7f03c052d000 rw-p 00002000 08:02 570036                     /usr/lib64/imlib2/loaders/jpeg.so
7f03c052d000-7f03c0530000 r-xp 00000000 08:02 570053                     /usr/lib64/imlib2/loaders/lbm.so
7f03c0530000-7f03c072f000 ---p 00003000 08:02 570053                     /usr/lib64/imlib2/loaders/lbm.so
7f03c072f000-7f03c0730000 r--p 00002000 08:02 570053                     /usr/lib64/imlib2/loaders/lbm.so
7f03c0730000-7f03c0731000 rw-p 00003000 08:02 570053                     /usr/lib64/imlib2/loaders/lbm.so
7f03c0731000-7f03c0756000 r-xp 00000000 08:02 503454                     /usr/lib64/libpng12.so.0.37.0
7f03c0756000-7f03c0955000 ---p 00025000 08:02 503454                     /usr/lib64/libpng12.so.0.37.0
7f03c0955000-7f03c0956000 r--p 00024000 08:02 503454                     /usr/lib64/libpng12.so.0.37.0
7f03c0956000-7f03c0957000 rw-p 00025000 08:02 503454                     /usr/lib64/libpng12.so.0.37.0
7f03c0957000-7f03c095a000 r-xp 00000000 08:02 570040                     /usr/lib64/imlib2/loaders/png.so
7f03c095a000-7f03c0b59000 ---p 00003000 08:02 570040                     /usr/lib64/imlib2/loaders/png.so
7f03c0b59000-7f03c0b5a000 r--p 00002000 08:02 570040                     /usr/lib64/imlib2/loaders/png.so
7f03c0b5a000-7f03c0b5b000 rw-p 00003000 08:02 570040                     /usr/lib64/imlib2/loaders/png.so
7f03c0b5b000-7f03c0b5e000 r-xp 00000000 08:02 570057                     /usr/lib64/imlib2/loaders/pnm.so
7f03c0b5e000-7f03c0d5d000 ---p 00003000 08:02 570057                     /usr/lib64/imlib2/loaders/pnm.so
7f03c0d5d000-7f03c0d5e000 r--p 00002000 08:02 570057                     /usr/lib64/imlib2/loaders/pnm.so
Program received signal SIGABRT, Aborted.
0x00007f03c3f3ef25 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
	in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt 
#0  0x00007f03c3f3ef25 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007f03c3f402c0 in abort () at abort.c:88
#2  0x00007f03c3f7a238 in __libc_message (do_abort=2, 
    fmt=0x7f03c4028b77 "*** %s ***: %s terminated\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
#3  0x00007f03c3ff04e7 in __fortify_fail (msg=0x7f03c4028b37 "buffer overflow detected")
    at fortify_fail.c:32
#4  0x00007f03c3fee320 in __chk_fail () at chk_fail.c:29
#5  0x00007f03c3fed8db in ___vsnprintf_chk (s=0x1e10927 "", maxlen=26038, flags=1, 
    slen=18446744073709551615, format=0x415a9b "motionnotify %d %d\n", args=0x7fff186ec5b0)
    at vsnprintf_chk.c:39
#6  0x0000000000413d32 in event (format=0x415a9b "motionnotify %d %d\n")
    at /usr/include/bits/stdio2.h:78
#7  0x0000000000407caa in adesklets_events_loop () at adesklets.c:2930
#8  0x00000000004065c5 in main (argc=2, argv=0x7fff186ec9b8) at main.c:104
(gdb) bt full
#0  0x00007f03c3f3ef25 in raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
	pid = <value optimized out>
	selftid = <value optimized out>
#1  0x00007f03c3f402c0 in abort () at abort.c:88
	act = {__sigaction_handler = {sa_handler = 0x7fff186eba70, 
    sa_sigaction = 0x7fff186eba70}, sa_mask = {__val = {140733603298048, 38654705664, 
      140733603298112, 140733603303435, 9, 139654150121709, 1, 4207636, 31, 139654150125986, 3, 
      140733603298093, 3, 139654150121735, 1, 139654150130480}}, sa_flags = 3, 
  sa_restorer = 0x7fff186ebb3a}
	sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007f03c3f7a238 in __libc_message (do_abort=2, 
    fmt=0x7f03c4028b77 "*** %s ***: %s terminated\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
	ap = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7fff186ec410, 
    reg_save_area = 0x7fff186ec320}}
	ap_copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff186ec410, 
    reg_save_area = 0x7fff186ec320}}
	fd = 9
	on_2 = <value optimized out>
	list = <value optimized out>
	nlist = <value optimized out>
	cp = <value optimized out>
	written = 6
#3  0x00007f03c3ff04e7 in __fortify_fail (msg=0x7f03c4028b37 "buffer overflow detected")
    at fortify_fail.c:32
No locals.
#4  0x00007f03c3fee320 in __chk_fail () at chk_fail.c:29
No locals.
#5  0x00007f03c3fed8db in ___vsnprintf_chk (s=0x1e10927 "", maxlen=26038, flags=1, 
    slen=18446744073709551615, format=0x415a9b "motionnotify %d %d\n", args=0x7fff186ec5b0)
    at vsnprintf_chk.c:39
	sf = {f = {_sbf = {_f = {_flags = 47877864, _IO_read_ptr = 0x7f03c4e3fc90 "\2378@", 
        _IO_read_end = 0x7f03c4e62358 "�\"��\003\177", 
        _IO_read_base = 0x7fff186ec540 "\230t��\003\177", _IO_write_base = 0x7f03c4e62000 "", 
        _IO_write_ptr = 0x403743 "__vsnprintf_chk", _IO_write_end = 0x7f03c4e61658 "", 
        _IO_buf_base = 0x7f03c494abc8 "_XPutBackEvent", _IO_buf_end = 0x7f03c4948eb8 "", 
        _IO_save_base = 0x7f03c49475b0 "\020\035", 
        _IO_backup_base = 0x100000000 <Address 0x100000000 out of bounds>, 
        _IO_save_end = 0x10000044b <Address 0x10000044b out of bounds>, 
        _markers = 0x7f03c4948eb8, _chain = 0x7f03c4e619b0, _fileno = 409912816, 
        _flags2 = 32767, _old_offset = 140733603300792, _cur_column = 29848, 
        _vtable_offset = -15 '�', _shortbuf = "�", _lock = 0x7f03c4e439a8, _offset = 0, 
        _codecvt = 0xffffffff, _wide_data = 0x0, _freeres_list = 0x61e270, _freeres_buf = 0x6, 
        _freeres_size = 31524720, _mode = 1, 
        _unused2 = "\000\000\000\000\002", '\0' <repeats 14 times>}, vtable = 0x7f03c4c540a0}, 
    _s = {_allocate_buffer = 0x1, _free_buffer = 0}}, 
  overflow_buf = "p\a�\001\000\000\000\000\001\000\000\000\a\000\000\000\230t��\003\177\000\000 \t�\001\000\000\000\000\233ZA\000\000\000\000\000�\237��\003\177\000\000��n\030�\177\000\000]\000\000\000\000\000\000"}
	ret = <value optimized out>
#6  0x0000000000413d32 in event (format=0x415a9b "motionnotify %d %d\n")
    at /usr/include/bits/stdio2.h:78
	ap = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7fff186ec6b0, 
    reg_save_area = 0x7fff186ec5e0}}
	PREFIX = "event: "
#7  0x0000000000407caa in adesklets_events_loop () at adesklets.c:2930
	menu_str = 0x1e0f7f0 "/lib"
	list = (char **) 0x7fff186ec850
	x = 0
	y = 0
	i = 0
	j = 80
	k = 409913424
	width = 414
	height = 158
	mask = 140733603301456
	angle = 0.050000000000000003
	sleep_time = {tv_sec = 0, tv_nsec = 2000}
	command_type = CMD_TIME_GATE
	params = (vector *) 0x1e10690
	ev = {type = 6, xany = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, 
    window = 41943041}, xkey = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, 
    window = 41943041, root = 275, subwindow = 0, time = 531187896, x = 74, y = 84, x_root = 74, 
    y_root = 84, state = 0, keycode = 4278190080, same_screen = 1}, xbutton = {type = 6, 
    serial = 176, send_event = 0, display = 0x1d6c850, window = 41943041, root = 275, 
    subwindow = 0, time = 531187896, x = 74, y = 84, x_root = 74, y_root = 84, state = 0, 
    button = 4278190080, same_screen = 1}, xmotion = {type = 6, serial = 176, send_event = 0, 
    display = 0x1d6c850, window = 41943041, root = 275, subwindow = 0, time = 531187896, x = 74, 
    y = 84, x_root = 74, y_root = 84, state = 0, is_hint = 0 '\0', same_screen = 1}, 
    root = 275, subwindow = 0, time = 531187896, x = 74, y = 84, x_root = 74, y_root = 84, 
    mode = 0, detail = -16777216, same_screen = 1, focus = -16777216, state = 4279898404}, 
  xfocus = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, window = 41943041, 
    mode = 275, detail = 0}, xexpose = {type = 6, serial = 176, send_event = 0, 
    display = 0x1d6c850, window = 41943041, x = 275, y = 0, width = 0, height = 0, 
    count = 531187896}, xgraphicsexpose = {type = 6, serial = 176, send_event = 0, 
    display = 0x1d6c850, drawable = 41943041, x = 275, y = 0, width = 0, height = 0, 
    count = 531187896, major_code = 0, minor_code = 74}, xnoexpose = {type = 6, serial = 176, 
    send_event = 0, display = 0x1d6c850, drawable = 41943041, major_code = 275, minor_code = 0}, 
  xvisibility = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, window = 41943041, 
    state = 275}, xcreatewindow = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, 
    parent = 41943041, window = 275, x = 0, y = 0, width = 531187896, height = 0, 
    border_width = 74, override_redirect = 84}, xdestroywindow = {type = 6, serial = 176, 
    send_event = 0, display = 0x1d6c850, event = 41943041, window = 275}, xunmap = {type = 6, 
    serial = 176, send_event = 0, display = 0x1d6c850, event = 41943041, window = 275, 
    from_configure = 0}, xmap = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, 
    event = 41943041, window = 275, override_redirect = 0}, xmaprequest = {type = 6, 
    serial = 176, send_event = 0, display = 0x1d6c850, parent = 41943041, window = 275}, 
  xreparent = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, event = 41943041, 
    window = 275, parent = 0, x = 531187896, y = 0, override_redirect = 74}, xconfigure = {
    type = 6, serial = 176, send_event = 0, display = 0x1d6c850, event = 41943041, window = 275, 
    x = 0, y = 0, width = 531187896, height = 0, border_width = 74, above = 360777252938, 
    override_redirect = 0}, xgravity = {type = 6, serial = 176, send_event = 0, 
    display = 0x1d6c850, event = 41943041, window = 275, x = 0, y = 0}, xresizerequest = {
    type = 6, serial = 176, send_event = 0, display = 0x1d6c850, window = 41943041, width = 275, 
    height = 0}, xconfigurerequest = {type = 6, serial = 176, send_event = 0, 
    display = 0x1d6c850, parent = 41943041, window = 275, x = 0, y = 0, width = 531187896, 
    height = 0, border_width = 74, above = 360777252938, detail = 0, 
    value_mask = 18374686479671623681}, xcirculate = {type = 6, serial = 176, send_event = 0, 
    display = 0x1d6c850, event = 41943041, window = 275, place = 0}, xcirculaterequest = {
    type = 6, serial = 176, send_event = 0, display = 0x1d6c850, parent = 41943041, 
    window = 275, place = 0}, xproperty = {type = 6, serial = 176, send_event = 0, 
    display = 0x1d6c850, window = 41943041, atom = 275, time = 0, state = 531187896}, 
  xselectionclear = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, 
    window = 41943041, selection = 275, time = 0}, xselectionrequest = {type = 6, serial = 176, 
    send_event = 0, display = 0x1d6c850, owner = 41943041, requestor = 275, selection = 0, 
    target = 531187896, property = 360777252938, time = 360777252938}, xselection = {type = 6, 
    serial = 176, send_event = 0, display = 0x1d6c850, requestor = 41943041, selection = 275, 
    target = 0, property = 531187896, time = 360777252938}, xcolormap = {type = 6, serial = 176, 
    send_event = 0, display = 0x1d6c850, window = 41943041, colormap = 275, new = 0, state = 0}, 
  xclient = {type = 6, serial = 176, send_event = 0, display = 0x1d6c850, window = 41943041, 
    message_type = 275, format = 0, data = {
      b = "�H�\037\000\000\000\000J\000\000\000T\000\000\000J\000\000", s = {18616, 8105, 0, 0, 
        74, 0, 84, 0, 74, 0}, l = {531187896, 360777252938, 360777252938, -72057594037927936, 
        -72057594037927935}}}, xmapping = {type = 6, serial = 176, send_event = 0, 
    display = 0x1d6c850, window = 41943041, request = 275, first_keycode = 0, count = 0}, 
  xerror = {type = 6, display = 0xb0, resourceid = 18374686479671623680, serial = 30853200, 
    error_code = 1 '\001', request_code = 0 '\0', minor_code = 128 '\200'}, xkeymap = {type = 6, 
    serial = 176, send_event = 0, display = 0x1d6c850, window = 41943041, 
    key_vector = "\023\001", '\0' <repeats 14 times>, "�H�\037\000\000\000\000J\000\000\000T\000\000"}, pad = {-72057594037927930, 176, -72057594037927936, 30853200, 41943041, 275, 0, 531187896, 
    360777252938, 360777252938, -72057594037927936, -72057594037927935, -61616412592303836, 
    -11596682288261203, -15273496413618986, -14423565333305874, -26576643451209775, 
    -20350053278079425, -61616412590923205, -61616412591383756, -61616412591581134, 
    -61616412591581134, -61616412591581134, -61616412591581134}}
	history = (HIST_ENTRY **) 0x6
	file = (FILE *) 0x7fff186ec850
	cd = (iconv_t) 0x7fff186ec850
	updates = (Imlib_Updates) 0x0
	image = (Imlib_Image) 0x7fff186ec850
	color = {alpha = 0, red = 0, green = 0, blue = 0}
	font = (Imlib_Font) 0x7fff186ec850
	color_range = (Imlib_Color_Range) 0x7fff186ec850
	color_modifier = (Imlib_Color_Modifier) 0x7fff186ec850
	filter = (Imlib_Filter) 0x7fff186ec850
	polygon = <value optimized out>
	error = IMLIB_LOAD_ERROR_NONE
	data = (unsigned int *) 0x7fff186ec850
	tables = {0x0, 0x0, 0x0, 0x0}
#8  0x00000000004065c5 in main (argc=2, argv=0x7fff186ec9b8) at main.c:104
No locals.
(gdb) quit
The program is running.  Quit anyway (and detach it)? (y or n) y
Detaching from program: /usr/bin/adesklets, process 26038