Bug 287332 – app-admin/apachetop-0.12.6 crashing with buffer overflow detected

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Honza 2009-10-02 09:57:36 UTC]

Normally compiled apachetop-0.12.6 crash with buffer overflow detected when executed.

When I modify MAXPATHLEN to 4096 in src/apachetop.h (inside #ifndef MAXPATHLEN) in stopped emerge it doesn't crash. Therefore I assume problem is in missing MAXPATHLEN somewhere.

Similar problem was found by ubuntu ( https://bugs.launchpad.net/ubuntu/+source/apachetop/+bug/294599 ) but using their patch apachetop will not even compile.

Reproducible: Always

Steps to Reproduce:
1. emerge apachetop
2. run it


Actual Results:  
*** buffer overflow detected ***: apachetop terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x48)[0xb7ddb3e8]
/lib/libc.so.6[0xb7dd9490]
/lib/libc.so.6[0xb7dd9be8]
apachetop[0xb8046e2c]
======= Memory map: ========
b7ccd000-b7ccf000 rw-p b7ccd000 00:00 0 
b7ccf000-b7cde000 r-xp 00000000 08:03 525830     /lib/libbz2.so.1.0.5
b7cde000-b7cdf000 r--p 0000e000 08:03 525830     /lib/libbz2.so.1.0.5
b7cdf000-b7ce0000 rw-p 0000f000 08:03 525830     /lib/libbz2.so.1.0.5
b7ce0000-b7cf2000 r-xp 00000000 08:03 45341      /lib/libz.so.1.2.3
b7cf2000-b7cf4000 rw-p 00012000 08:03 45341      /lib/libz.so.1.2.3
b7cf4000-b7cf6000 r-xp 00000000 08:03 504614     /lib/libdl-2.9.so
b7cf6000-b7cf7000 r--p 00001000 08:03 504614     /lib/libdl-2.9.so
b7cf7000-b7cf8000 rw-p 00002000 08:03 504614     /lib/libdl-2.9.so
b7cf8000-b7e35000 r-xp 00000000 08:03 504545     /lib/libc-2.9.so
b7e35000-b7e37000 r--p 0013c000 08:03 504545     /lib/libc-2.9.so
b7e37000-b7e38000 rw-p 0013e000 08:03 504545     /lib/libc-2.9.so
b7e38000-b7e3b000 rw-p b7e38000 00:00 0 
b7e3b000-b7e47000 r-xp 00000000 08:03 117429     /usr/lib/gcc/i686-pc-linux-gnu/4.3.3/libgcc_s.so.1
b7e47000-b7e48000 r--p 0000b000 08:03 117429     /usr/lib/gcc/i686-pc-linux-gnu/4.3.3/libgcc_s.so.1
b7e48000-b7e49000 rw-p 0000c000 08:03 117429     /usr/lib/gcc/i686-pc-linux-gnu/4.3.3/libgcc_s.so.1
b7e49000-b7e4a000 rw-p b7e49000 00:00 0 
b7e4a000-b7e6e000 r-xp 00000000 08:03 504610     /lib/libm-2.9.so
b7e6e000-b7e6f000 r--p 00023000 08:03 504610     /lib/libm-2.9.so
b7e6f000-b7e70000 rw-p 00024000 08:03 504610     /lib/libm-2.9.so
b7e70000-b7f52000 r-xp 00000000 08:03 117410     /usr/lib/gcc/i686-pc-linux-gnu/4.3.3/libstdc++.so.6.0.10
b7f52000-b7f57000 r--p 000e1000 08:03 117410     /usr/lib/gcc/i686-pc-linux-gnu/4.3.3/libstdc++.so.6.0.10
b7f57000-b7f58000 rw-p 000e6000 08:03 117410     /usr/lib/gcc/i686-pc-linux-gnu/4.3.3/libstdc++.so.6.0.10
b7f58000-b7f5d000 rw-p b7f58000 00:00 0 
b7f5d000-b7f8e000 r-xp 00000000 08:03 310197     /usr/lib/libpcre.so.0.0.1
b7f8e000-b7f8f000 r--p 00030000 08:03 310197     /usr/lib/libpcre.so.0.0.1
b7f8f000-b7f90000 rw-p 00031000 08:03 310197     /usr/lib/libpcre.so.0.0.1
b7f90000-b7fd4000 r-xp 00000000 08:03 102408     /lib/libncurses.so.5.6
b7fd4000-b7fdb000 r--p 00044000 08:03 102408     /lib/libncurses.so.5.6
b7fdb000-b7fdd000 rw-p 0004b000 08:03 102408     /lib/libncurses.so.5.6
b7fdd000-b8005000 r-xp 00000000 08:03 34077      /lib/libreadline.so.5.0
b8005000-b8009000 rw-p 00027000 08:03 34077      /lib/libreadline.so.5.0
b8009000-b800b000 rw-p b8009000 00:00 0 
b8027000-b8043000 r-xp 00000000 08:03 504489     /lib/ld-2.9.so
b8043000-b8044000 r--p 0001b000 08:03 504489     /lib/ld-2.9.so
b8044000-b8045000 rw-p 0001c000 08:03 504489     /lib/ld-2.9.so
b8045000-b804f000 r-xp 00000000 08:03 11006      /usr/bin/apachetop
b804f000-b8050000 r--p 00009000 08:03 11006      /usr/bin/apachetop
b8050000-b8051000 rw-p 0000a000 08:03 11006      /usr/bin/apachetop
b8051000-b8072000 rw-p b8051000 00:00 0          [heap]
bfc38000-bfc4e000 rw-p bffea000 00:00 0          [stack]
ffffe000-fffff000 r-xp 00000000 00:00 0          [vdso]
Aborted



# emerge --info
Portage 2.1.6.13 (hardened/linux/x86/10.0, gcc-4.3.3, glibc-2.9_p20081201-r2, 2.6.27-gentoo-r8-32 i686)
=================================================================
System uname: Linux-2.6.27-gentoo-r8-32-i686-AMD_Athlon-tm-_64_X2_Dual_Core_Processor_4200+-with-glibc2.3.2
Timestamp of tree: Thu, 01 Oct 2009 21:45:03 +0000
app-shells/bash:     3.2_p39
dev-java/java-config: 1.3.7-r1, 2.1.7
dev-lang/python:     2.4.6, 2.5.4-r3
dev-python/pycrypto: 2.0.1-r8
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.6-r2
sys-devel/autoconf:  2.13, 2.61-r2
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1, 1.10.1
sys-devel/binutils:  2.15.92.0.2-r10, 2.16.1-r3, 2.18-r3
sys-devel/gcc-config: 1.4.1
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.27-r2
ACCEPT_KEYWORDS="x86"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -mcpu=athlon -march=i686 -fomit-frame-pointer -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb /usr/share/config /var/bind"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php4/ext-active/ /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php4/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php4/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -mcpu=athlon -march=i686 -fomit-frame-pointer -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="distlocks fixpackages parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="ftp://ftp.tu-clausthal.de/pub/linux/gentoo http://ftp.sh.cvut.cz/MIRRORS/gentoo/gentoo/ http://www.mirror.ac.uk/sites/www.ibiblio.org/gentoo/ http://gentoo.oregonstate.edu http://www.ibiblio.org/pub/Linux/distributions/gentoo"
LDFLAGS="-Wl,-O1"
LINGUAS="en cs en_GB"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="3dnow 3dnowext X Xaw3d aalib acl apache2 apm avi berkdb bzip2 caps cdr cli cracklib crypt cups curl dga divx4linux djvu doc dri encode erandom esd exif expat flac fpx gcj gd gdbm gif gnutls gpm graphviz gtk hardened iconv imagemagick imlib innodb ipv6 isdnlog java jbig jpeg lcms lesstif libcaca libwww live logrotate lua lzo mad mailwrapper mbox mcal memlimit mhash mikmod mmx mmxext mng modules motif mozilla mpeg mudflap multislot mysql ncurses network nls nptl oggvorbis openal oss pam pcntl pcre pdflib perl pic png postscript pppd python qt quicktime readline reflection samba sdl session snmp spell spl sqlite sse ssl svga sysfs tcpd tetex theora tiff truetype unicode urandom usb userlocales vhosts videos wmf x264 x86 xgetdefault xml xorg xosd xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1         emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m       maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="access auth auth_dbm auth_anon auth_digest alias file-cache echo charset-lite cache disk-cache mem-cache ext-filter case_filter case-filter-in deflate mime-magic cern-meta expires headers usertrack unique-id proxy proxy-connect proxy-ftp proxy-http info include cgi cgid dav dav-fs vhost-alias speling rewrite log_config logio env setenvif mime status autoindex asis negotiation dir imap actions userdir so filter unique_id authz_host auth_basic authn_dbd authn_file authz_owner authz_user charset_lite dbd mem_cache" APACHE2_MPMS="prefork" ELIBC="glibc" INPUT_DEVICES="evdev keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en cs en_GB" USERLAND="GNU" VIDEO_CARDS="radeon nv vesa fbdev"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

[Comment 1 Honza 2009-10-02 10:02:01 UTC]

By "missing MAXPATHLEN" I mean missing include defining MAXPATHLEN (probably sys/param.h, at least thats the one I have it defined in).

[Comment 2 Robert Hughes 2009-11-06 16:29:06 UTC]

Same problem here with x64

[Comment 3 Florian Faber 2009-12-09 17:34:23 UTC]

There's a patch out there for about 15 months now:

https://bugzilla.redhat.com/attachment.cgi?id=309968

[Comment 4 Florian Faber 2009-12-09 17:39:04 UTC]

Created attachment 212559 [details]
apachetop 0.12.6 with maxpathlen patch

Contains a new ebuild and the patch.

[Comment 5 Benedikt Böhm (RETIRED) 2010-01-11 08:15:51 UTC]

fixed, thanks

[Comment 6 Yiannis Kontekakis 2011-02-06 13:41:20 UTC]

How about unmasking it also? Thanks :)