Bug 101257 – amap-5.1 crash with invalid free() while checking for updates

• Status: RESOLVED WORKSFORME
• Product: Gentoo Linux

[Description Nicob 2005-08-03 15:17:18 UTC]

When using the online update feature of Amap 5.1 (compiled with SSL support), 
the process is aborted (SIGABRT) and the following text is displayed : "*** 
glibc detected *** free(): invalid next size (normal): 0x08056968 ***"

Reproducible: Always
Steps to Reproduce:
1. run 'emerge -va net-analyzer/amap-5.1'
2. run 'amap -W'

Actual Results:  
Crash :
$#> amap -W
Running Online Update for fingerprints, connecting to www.thc.org/thc-amap
*** glibc detected *** free(): invalid next size (normal): 0x08056968 ***
zsh: 18306 abort      amap -W
$#>

Expected Results:  
Check the www.thc.org/thc-amap for updates.

[Comment 1 Nicob 2005-08-03 15:18:20 UTC]

Portage 2.0.51.22-r2 (default-linux/x86/2005.0, gcc-3.3.5-20050130, glibc-2.3.5-
r0, 2.6.11-gentoo-r11050619-1 i686)
=================================================================
System uname: 2.6.11-gentoo-r11050619-1 i686 Intel(R) Pentium(R) M processor 1.
60GHz
Gentoo Base System version 1.12.0_pre3
dev-lang/python:     2.3.5
sys-apps/sandbox:    1.2.11
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.5
sys-devel/binutils:  2.15.92.0.2-r10
sys-devel/libtool:   1.5.18-r1
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=i686 -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config /usr/share/
config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/env.d"
CXXFLAGS="-O2 -pipe -march=i686 -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/Linux/
distributions/gentoo"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X alsa apm arts avi berkdb bitmap-fonts cdr crypt cups curl eds emboss 
encode esd fam foomaticdb fortran freetds gd gdbm gif gnome gphoto2 gpm 
gstreamer gtk gtk2 imagemagick imlib ipv6 java jpeg ldap libg++ libwww mad 
mikmod motif mp3 mpeg mysql ncurses nls odbc ogg oggvorbis opengl oss pam pdflib 
perl png python quicktime readline samba sdl snmp spell ssl svga tcltk tcpd tiff 
truetype truetype-fonts type1-fonts vorbis xml2 xmms xv zlib userland_GNU 
kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LANG, LC_ALL, LDFLAGS, LINGUAS, MAKEOPTS

[Comment 2 Michael Zanetta 2005-09-11 13:30:08 UTC]

Hello, I had the same problem just after upgrading glibc to 3.3.5.
amap-5.1 worked fine before.

Regards,

Michael

[Comment 3 Marcelo Goes (RETIRED) 2005-09-11 14:09:19 UTC]

Created attachment 68194 [details, diff]
amap-5.1-crash.log

[Comment 4 Marcelo Goes (RETIRED) 2005-09-11 15:09:52 UTC]

I can't really tell why this is crashing. The problem narrows down to this:
"target = gethostbyname(host)". I already separated gethostbyname() from the if
condition and it still crashes, even if I hardcode a host, such as
gethostbyname("gentoo.org"). However, gethostbyname() by itself seems to be
working ok:

gethost.c:

#include <netdb.h>

main(){
gethostbyname("gentoo.org");
}

:-(

[Comment 5 Marco Morales 2005-09-27 17:19:22 UTC]

As Michael said, its kinda related with glibc version. Here it works with 2.3.4 
but it doesnt with 2.3.5. 

[Comment 6 Marcelo Goes (RETIRED) 2005-09-27 18:23:29 UTC]

Created attachment 69385 [details, diff]
amap-5.1-bla.diff

Any of you mind testing this patch? It reverts the piece of borked code to
5.0's.

[Comment 7 Marco Morales 2005-09-27 18:37:14 UTC]

it worked here ;)

[Comment 8 Michael Zanetta 2005-09-29 13:01:27 UTC]

Created attachment 69519 [details]
amap.cap

Well, can somebody explain this?
Amap directly connects to an IP address comming from nowhere, not present in
the source code...
72.96.5.8
No dns lookup, direct tcp connection, and not the www.thc.org ip address...

Mmmmh, is it trojanized ? ;-)

Any hints?

[Comment 9 Marcelo Goes (RETIRED) 2005-11-26 18:30:03 UTC]

No idea whether it is trojanized, but something to keep an eye on :-|.
If anyone wants to pick this up, 5.2 is out...

[Comment 10 Michael Zanetta 2005-12-06 15:57:15 UTC]

I tested with the 5.2 and got the same problem.

Does it work with a more recent glibc? I don't have time to test this at the
moment...

[Comment 11 Marcelo Goes (RETIRED) 2006-01-15 17:26:04 UTC]

Just tested amap-5.2 with glibc-2.3.6-r2, same problem.

[Comment 12 Marcelo Goes (RETIRED) 2006-01-17 08:39:14 UTC]

From upstream:

"so I checked out the code, and I find no reason for this.
a crash would occure if malloc() fails, but then a SEGV would
occur. from your output I see that the malloc succeeds, but
somehow free() is called twice. but this does not happen in
that code.
as online update works for me (5.2), I would guess its
a glibc problem."

[Comment 13 Markus Ullmann (RETIRED) 2006-10-08 11:18:13 UTC]

vanquirius: Still an issue here with latest glibc and latest amap

[Comment 14 Markus Ullmann (RETIRED) 2006-11-21 02:40:56 UTC]

Seems to be okay again with recent ~x86 versions, anyone having issues -> reopen the bug