Bug 159096 – stack smashing attack in games-fps/nexuiz-2.2.1

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Jan Kundrát (RETIRED) 2006-12-25 14:51:40 UTC]

When I run games-fps/nexuiz-2.2.1 compiled with a hardened compiler, it dies for a stack smahing attack when it's about to render something after I've moved. Please see the attached gdb backtrace and (optionally) a log of IRC chat with upstream devs.

Portage 2.1.1-r2 (hardened/x86/2.6, gcc-3.4.6, glibc-2.3.6-r5, 2.6.18-suspend2 i686)
=================================================================
System uname: 2.6.18-suspend2 i686 Genuine Intel(R) CPU           T2400  @ 1.83GHz
Gentoo Base System version 1.12.6
Last Sync: Sun, 24 Dec 2006 09:20:01 +0000
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.3.7, 2.0.30
dev-lang/python:     2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.60
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.14
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=prescott -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/splash /etc/terminfo"
CXXFLAGS="-O2 -march=prescott -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms splitdebug strict userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://ftp.sh.cvut.cz/MIRRORS/gentoo"
LINGUAS="en cs"
MAKEOPTS="-j3"
PKGDIR="/usr/portage//packages/x86/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage/"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="X a52 aac aalib acpi alsa alsa_cards_hda-intel alsa_pcm_plugins_adpcm alsa_pcm_plugins_alaw alsa_pcm_plugins_asym alsa_pcm_plugins_copy alsa_pcm_plugins_dmix alsa_pcm_plugins_dshare alsa_pcm_plugins_dsnoop alsa_pcm_plugins_empty alsa_pcm_plugins_extplug alsa_pcm_plugins_file alsa_pcm_plugins_hooks alsa_pcm_plugins_iec958 alsa_pcm_plugins_ioplug alsa_pcm_plugins_ladspa alsa_pcm_plugins_lfloat alsa_pcm_plugins_linear alsa_pcm_plugins_meter alsa_pcm_plugins_mulaw alsa_pcm_plugins_multi alsa_pcm_plugins_null alsa_pcm_plugins_plug alsa_pcm_plugins_rate alsa_pcm_plugins_route alsa_pcm_plugins_share alsa_pcm_plugins_shm alsa_pcm_plugins_softvol bash-completion berkdb bluetooth bzip2 cdparanoia crypt cscope css cups curl dbus dlloader doomsday dri dts dvb dvd dvdr dvdread elibc_glibc encode fam fbsplash ffmpeg flac gif hal hardened hdaps ieee1394 imlib input_devices_evdev input_devices_keyboard input_devices_mouse input_devices_synaptics ipv6 irda java jpeg kde kdeenablefinal kernel_linux libcaca linguas_cs linguas_en logrotate matroska mmx mp3 mpeg ncurses nls nptl nptlonly nsplugin ogg opengl pam pdf pic png ppds python qt3 readline samba smp speex spell sse sse2 sse3 ssl stream tga theora tiff truetype unicode usb userland_GNU userlocales vcd video_cards_fbdev video_cards_fglrx video_cards_radeon video_cards_vesa vim vorbis wifi x86 xine xinerama xorg xv xvid zlib"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS

(Sending to bug-wranglers as I'm not sure if it's for games or hardened or both...)

[Comment 1 Jan Kundrát (RETIRED) 2006-12-25 14:54:03 UTC]

Created attachment 104719 [details]
console dump of gdb session

[Comment 2 Jan Kundrát (RETIRED) 2006-12-25 14:55:06 UTC]

Created attachment 104720 [details]
#darkplaces from irc.anynet.org

[Comment 3 Mr. Bones. (RETIRED) 2007-02-28 18:20:55 UTC]

open a new bug if it's still a problem with 2.2.3.  thanks.