Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 138604 - sci-astronomy/stellarium-0.8.0: stack smashing attack in function void StelUI::init_tui()
Summary: sci-astronomy/stellarium-0.8.0: stack smashing attack in function void StelUI...
Status: RESOLVED TEST-REQUEST
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: The Gentoo Linux Hardened Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 135265
  Show dependency tree
 
Reported: 2006-06-30 11:10 UTC by schaedpq
Modified: 2009-03-21 15:51 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description schaedpq 2006-06-30 11:10:17 UTC
stellarium-0.8.0 is aborted due to a stack smashing attack in StelUI::init_tui() during start-up. Switching off SSP (e.g. using the vanilla gcc) of course removes the crash, but I don't know whether it is an SSP issue or just some problem in stellarium which is hidden without SSP.
I will attach a backtrace as soon as I manage to get a decent one (atm the debug symbols are missing, I will recompile stellarium in a few hours). Probably I will try stellarium-0.8.1 later which is currently in ~x86.

# stellarium
 -------------------------------------------------------
[ This is Stellarium 0.8.0 - http://www.stellarium.org ]
[ Copyright (C) 2000-2005 Fabien Chereau et al         ]
 -------------------------------------------------------
Application locale is system
Loading Solar System data...(loaded)
Loading location: "Unknown observatory", on Earth (landscape is: "guereins")
Loading Hipparcos star data...(118217 stars loaded [2200 dropped]).
Loading Hipparcos double stars...(8824 stars loaded)
Loading Hipparcos periodic variable stars...(1930 stars loaded)
Load star names from /usr/share/stellarium/data/sky_cultures/western/star_names.fab
Loading NGC data... (13226 items loaded [3175 dropped])

...no position data for Barnard's galaxy
...no position data for Papillon
...no position data for γ Cas nebula Loading NGC name data...( 225 names loaded)
Loading Nebula Textures...(74 textures loaded)
Loading Constellation boundary data...(782 segments loaded)
Load star names from /usr/share/stellarium/data/sky_cultures/western/star_names.fab
Loading Cities data...(2069 cities loaded)
stellarium: stack smashing attack in function void StelUI::init_tui()()
Abgebrochen (core dumped)


# emerge --info
Portage 2.1.1_pre1-r2 (hardened/x86/2.6, gcc-hardenednopie, glibc-2.3.6-r4, 2.6.14-hardened-r8 i686)
=================================================================
System uname: 2.6.14-hardened-r8 i686 AMD Athlon(tm) 64 Processor 3500+
Gentoo Base System version 1.6.14
distcc 2.18.3 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [disabled]
dev-lang/python:     2.4.2
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1-r2
sys-devel/gcc-config: 1.3.13-r2
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-mtune=athlon64 -march=athlon64 -O2 -pipe -Wall -ggdb3"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/lib/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/postfix/sample /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-mtune=athlon64 -march=athlon64 -O2 -pipe -Wall -ggdb3"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks metadata-transfer parallel-fetch sandbox sfperms split-debug strict"
GENTOO_MIRRORS="http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror"
LINGUAS="de"
PKGDIR="/usr/portage//packages/x86/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage/"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://linux.rz.ruhr-uni-bochum.de/gentoo-portage"
USE="3dnow 3dnowext X a52 acpi alsa ash-completion berkdb bitmap-fonts cdparanoia crypt cups dga dlloader dri dv dvd dvdr dvdread encode font-server glx gtk gtk2 hardened imap isdnlog jabber kde kdeenablefinal live lzo mad matrox mbox mime mjpeg mmx mmxext mozcalendar mozsvg mp3 mpeg mplayer musicbrainz network nls nodrm nptl nptlonly nsplugin offensive ogg opengl pam pam_timestamp pdf pic png quicktime readline real sftplogging sse ssl tcpd theora truetype truetype-fonts type1 type1-fonts userlocales v4l v4l2 vorbis win32codecs x86 xmms xorg xprint xv zlib elibc_glibc input_devices_mouse input_devices_keyboard kernel_linux linguas_de userland_GNU video_cards_nv"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, MAKEOPTS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 schaedpq 2006-06-30 11:10:17 UTC
stellarium-0.8.0 is aborted due to a stack smashing attack in StelUI::init_tui() during start-up. Switching off SSP (e.g. using the vanilla gcc) of course removes the crash, but I don't know whether it is an SSP issue or just some problem in stellarium which is hidden without SSP.
I will attach a backtrace as soon as I manage to get a decent one (atm the debug symbols are missing, I will recompile stellarium in a few hours). Probably I will try stellarium-0.8.1 later which is currently in ~x86.

# stellarium
 -------------------------------------------------------
[ This is Stellarium 0.8.0 - http://www.stellarium.org ]
[ Copyright (C) 2000-2005 Fabien Chereau et al         ]
 -------------------------------------------------------
Application locale is system
Loading Solar System data...(loaded)
Loading location: "Unknown observatory", on Earth (landscape is: "guereins")
Loading Hipparcos star data...(118217 stars loaded [2200 dropped]).
Loading Hipparcos double stars...(8824 stars loaded)
Loading Hipparcos periodic variable stars...(1930 stars loaded)
Load star names from /usr/share/stellarium/data/sky_cultures/western/star_names.fab
Loading NGC data... (13226 items loaded [3175 dropped])

...no position data for Barnard's galaxy
...no position data for Papillon
...no position data for γ Cas nebula Loading NGC name data...( 225 names loaded)
Loading Nebula Textures...(74 textures loaded)
Loading Constellation boundary data...(782 segments loaded)
Load star names from /usr/share/stellarium/data/sky_cultures/western/star_names.fab
Loading Cities data...(2069 cities loaded)
stellarium: stack smashing attack in function void StelUI::init_tui()()
Abgebrochen (core dumped)


# emerge --info
Portage 2.1.1_pre1-r2 (hardened/x86/2.6, gcc-hardenednopie, glibc-2.3.6-r4, 2.6.14-hardened-r8 i686)
=================================================================
System uname: 2.6.14-hardened-r8 i686 AMD Athlon(tm) 64 Processor 3500+
Gentoo Base System version 1.6.14
distcc 2.18.3 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [disabled]
dev-lang/python:     2.4.2
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1-r2
sys-devel/gcc-config: 1.3.13-r2
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-mtune=athlon64 -march=athlon64 -O2 -pipe -Wall -ggdb3"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/lib/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/postfix/sample /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-mtune=athlon64 -march=athlon64 -O2 -pipe -Wall -ggdb3"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks metadata-transfer parallel-fetch sandbox sfperms split-debug strict"
GENTOO_MIRRORS="http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror"
LINGUAS="de"
PKGDIR="/usr/portage//packages/x86/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage/"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://linux.rz.ruhr-uni-bochum.de/gentoo-portage"
USE="3dnow 3dnowext X a52 acpi alsa ash-completion berkdb bitmap-fonts cdparanoia crypt cups dga dlloader dri dv dvd dvdr dvdread encode font-server glx gtk gtk2 hardened imap isdnlog jabber kde kdeenablefinal live lzo mad matrox mbox mime mjpeg mmx mmxext mozcalendar mozsvg mp3 mpeg mplayer musicbrainz network nls nodrm nptl nptlonly nsplugin offensive ogg opengl pam pam_timestamp pdf pic png quicktime readline real sftplogging sse ssl tcpd theora truetype truetype-fonts type1 type1-fonts userlocales v4l v4l2 vorbis win32codecs x86 xmms xorg xprint xv zlib elibc_glibc input_devices_mouse input_devices_keyboard kernel_linux linguas_de userland_GNU video_cards_nv"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, MAKEOPTS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 2 schaedpq 2006-06-30 12:13:33 UTC
OK, what I got is this, which is probably not of much use...

(gdb) bt full
#0  0x029fd802 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
No symbol table info available.
#1  0x02e4cd56 in kill () from /lib/libc.so.6
No symbol table info available.
#2  0x02e3951e in __stack_smash_handler () from /lib/libc.so.6
No symbol table info available.
#3  0x080fc04a in StelUI::init_tui (this=0x838e230) at stel_ui_tuiconf.cpp:258
No locals.
#4  0x00000000 in ?? ()
No symbol table info available.


Additionally I checked stellarium-0.8.1. Well, it does crash due to a stack smashing attack, in a different function (upstream did apparantly change the relevant code) but I think, it is the same issue.

# stellarium
 -------------------------------------------------------
[ This is Stellarium 0.8.1 - http://www.stellarium.org ]
[ Copyright (C) 2000-2006 Fabien Chereau et al         ]
 -------------------------------------------------------
Application locale is system
Localizing TUI for locale: system
Loading Solar System data...(loaded)
Loading location: "Paris", on Earth (landscape is: "guereins")
Loading Hipparcos star data...(118217 stars loaded [2200 dropped]).
Loading Hipparcos double stars...(8824 stars loaded)
Loading Hipparcos periodic variable stars...(1930 stars loaded)
Load star names from /usr/share/stellarium/data/sky_cultures/western/star_names.fab
Loading NGC data... (13226 items loaded [3175 dropped])

...no position data for Barnard's galaxy
...no position data for Papillon
...no position data for γ Cas nebula Loading NGC name data...( 225 names loaded)
Loading Nebula Textures...(74 textures loaded)
Loading Constellation boundary data...(782 segments loaded)
Load star names from /usr/share/stellarium/data/sky_cultures/western/star_names.fab
Loading Cities data...(2069 cities loaded)
Localizing TUI for locale: system
stellarium: stack smashing attack in function void StelUI::localizeTui()()
Abgebrochen (core dumped)

The backtrace in this case is:
(gdb) bt full
#0  0x029b5802 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
No symbol table info available.
#1  0x02e04d56 in kill () from /lib/libc.so.6
No symbol table info available.
#2  0x02df151e in __stack_smash_handler () from /lib/libc.so.6
No symbol table info available.
#3  0x081020f6 in StelUI::localizeTui (this=0x83adf60) at stel_ui_tuiconf.cpp:428
        fontFile = {static npos = 4294967295, _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>},
    _M_p = 0x87a5b84 "/usr/share/stellarium/data/DejaVuSans.ttf"}}
        tmpstr = {static npos = 4294967295, _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>},
    _M_p = 0x8396024 "/usr/share/stellarium/data/DejaVuSansMono.ttf"}}
        fontScale = 1
        tmpfloat = 1
#4  0x02da9bf4 in std::ctype<char>::id () from /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libstdc++.so.6
No symbol table info available.
#5  0x00000000 in ?? ()
No symbol table info available.

localizeTui() is called at the very end of init_tui() and propably does some stuff, which was in init_tui() in stellarium-0.8.0.

I you think, I can provide more useful information, please ask. ;-)
Comment 3 schaedpq 2006-06-30 12:13:33 UTC
OK, what I got is this, which is probably not of much use...

(gdb) bt full
#0  0x029fd802 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
No symbol table info available.
#1  0x02e4cd56 in kill () from /lib/libc.so.6
No symbol table info available.
#2  0x02e3951e in __stack_smash_handler () from /lib/libc.so.6
No symbol table info available.
#3  0x080fc04a in StelUI::init_tui (this=0x838e230) at stel_ui_tuiconf.cpp:258
No locals.
#4  0x00000000 in ?? ()
No symbol table info available.


Additionally I checked stellarium-0.8.1. Well, it does crash due to a stack smashing attack, in a different function (upstream did apparantly change the relevant code) but I think, it is the same issue.

# stellarium
 -------------------------------------------------------
[ This is Stellarium 0.8.1 - http://www.stellarium.org ]
[ Copyright (C) 2000-2006 Fabien Chereau et al         ]
 -------------------------------------------------------
Application locale is system
Localizing TUI for locale: system
Loading Solar System data...(loaded)
Loading location: "Paris", on Earth (landscape is: "guereins")
Loading Hipparcos star data...(118217 stars loaded [2200 dropped]).
Loading Hipparcos double stars...(8824 stars loaded)
Loading Hipparcos periodic variable stars...(1930 stars loaded)
Load star names from /usr/share/stellarium/data/sky_cultures/western/star_names.fab
Loading NGC data... (13226 items loaded [3175 dropped])

...no position data for Barnard's galaxy
...no position data for Papillon
...no position data for γ Cas nebula Loading NGC name data...( 225 names loaded)
Loading Nebula Textures...(74 textures loaded)
Loading Constellation boundary data...(782 segments loaded)
Load star names from /usr/share/stellarium/data/sky_cultures/western/star_names.fab
Loading Cities data...(2069 cities loaded)
Localizing TUI for locale: system
stellarium: stack smashing attack in function void StelUI::localizeTui()()
Abgebrochen (core dumped)

The backtrace in this case is:
(gdb) bt full
#0  0x029b5802 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
No symbol table info available.
#1  0x02e04d56 in kill () from /lib/libc.so.6
No symbol table info available.
#2  0x02df151e in __stack_smash_handler () from /lib/libc.so.6
No symbol table info available.
#3  0x081020f6 in StelUI::localizeTui (this=0x83adf60) at stel_ui_tuiconf.cpp:428
        fontFile = {static npos = 4294967295, _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>},
    _M_p = 0x87a5b84 "/usr/share/stellarium/data/DejaVuSans.ttf"}}
        tmpstr = {static npos = 4294967295, _M_dataplus = {<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data fields>}, <No data fields>},
    _M_p = 0x8396024 "/usr/share/stellarium/data/DejaVuSansMono.ttf"}}
        fontScale = 1
        tmpfloat = 1
#4  0x02da9bf4 in std::ctype<char>::id () from /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/libstdc++.so.6
No symbol table info available.
#5  0x00000000 in ?? ()
No symbol table info available.

localizeTui() is called at the very end of init_tui() and propably does some stuff, which was in init_tui() in stellarium-0.8.0.

I you think, I can provide more useful information, please ask. ;-)
Comment 4 solar (RETIRED) gentoo-dev 2007-03-22 21:15:45 UTC
SSP on c++ is touchy when using gcc-3.x 
Comment 5 Markus Dittrich (RETIRED) gentoo-dev 2008-04-09 13:12:19 UTC
Is this still an issue with stellarium-0.9.1?

Thanks,
Markus
Comment 6 Sébastien Fabbro (RETIRED) gentoo-dev 2009-03-21 15:51:14 UTC
(In reply to comment #5)
> Is this still an issue with stellarium-0.9.1?
> 

Please re-open if this is still an issue on stellarium-0.10.2 or 0.9.1-r1.
Thanks.