Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 297467 - kde-base/kstars-4.3.4 stack smashing "attack" on hardened
Summary: kde-base/kstars-4.3.4 stack smashing "attack" on hardened
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo KDE team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-12-18 22:35 UTC by Hugo Mildenberger
Modified: 2010-01-27 14:07 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments
output of emerge --info =kde-base/kstars-4.3.4 (emerge--info-kde-base-kstars-4.3.4.txt,4.21 KB, text/plain)
2009-12-18 22:50 UTC, Hugo Mildenberger
Details
patch against kstars/kstars/skyobjects/saturnmoons.cpp (saturnmoons-fix-index-and-angle-errors.patch,7.47 KB, patch)
2009-12-20 17:07 UTC, Hugo Mildenberger
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Hugo Mildenberger 2009-12-18 22:35:51 UTC
kstars, when compiled with "-fstack-protector-all" gets aborted immediately after displaying the main window, saying something like:

*** stack smashing detected ***: kstars - terminated
kstars: stack smashing attack in function <unknown> - terminated
Report to http://bugs.gentoo.org/
Killed

drkonqi was as useless as usual, no core dump was generated, and also gdb was unable to intercept the problem, just because kstars got automagically terminated by signal 9.

Following the chain of symbols from the gcc source tree via __stack_chk_fail into the glibc source tree and from there into the related ebuild, it turned out that in order to get core dumps with hardened Gentoo, you need to emerge sys-libs/glibc with USE="debug", well, because: 

   # When using Hardened Gentoo stack handler, have smashes dump core for
   # analysis - debug only, as core could be an information leak
   # (paranoia).

This was done like ever since sys-libs/glibc-2.5.1, much as if ulimit and /etc/security/limits.conf was not availabe then.

Now, with proper signaling, I finally got a core:

#0  0x4f935422 in __kernel_vsyscall ()
#1  0x4da8909b in __stack_chk_fail () at stack_chk_fail.c:296
#2  0x119ea860 in __stack_chk_fail_local () from /usr/bin/kstars
#3  0x1196a40e in SaturnMoons::findPosition (this=0x134dc088, 
    num=0x5a98a2a0, Saturn=0x11b80fb0, Sun=0x11b782d8)
    at /usr/src/debug/kde-base/kstars-4.3.4/kstars-4.3.4/
       kstars/kstars/skyobjects/saturnmoons.cpp:476
#4  0x117fc86b in SaturnMoonsComponent::updateMoons (this=0x11b81dc0,
    num=0x5a98a2a0)
    at /usr/src/debug/kde-base/kstars-4.3.4/kstars-4.3.4/
        kstars/kstars/skycomponents/saturnmoonscomponent.cpp:65

Inspecting the code it was then easy to see that the method SaturnMoons::findPosition() has numerous off-by-one indexing errors. Until now, these probably had manifested itself only in wrong moon positions and other spurious errors. 

Some excerpts from kstars/skyobjects/saturnmoons.cpp:

109     double X[9], Y[9], Z[9];
110     double A1[9], B1[9], C1[9];
111     double A2[9], B2[9], C2[9];
112     double A3[9], B3[9], C3[9];
113     double A4[9], B4[9], C4[9];
114     double A5[9], B5[9], C5[9];
115     double A6[9], B6[9], C6[9];

[...]

 
428    X[9] = 0;
429    Y[9] = 0;
430    Z[9] = 1;
431
432    for ( int i=1; i<10; ++i ) {
433    A1[i] = X[i];
434    B1[i] = c1*Y[i] - s1*Z[i];
435    C1[i] = s1*Y[i] + c1*Z[i];
436
437   //Rotation towards the vernal equinox
438    A2[i] = c2*A1[i] - s2*B1[i];
439    B2[i] = s2*A1[i] + c2*B1[i];
440    C2[i] = C1[i];

[...]
Comment 1 Hugo Mildenberger 2009-12-18 22:50:08 UTC
Created attachment 213440 [details]
output of emerge --info =kde-base/kstars-4.3.4

Regarding missing core dumps, it could be useful to check the hardened reports
among #263681, #225563, #288419, #115285, #149292, #180451, #231225, #286587,
#202582, #191005 and #219589
Comment 2 Hugo Mildenberger 2009-12-19 11:45:44 UTC
https://bugs.kde.org/show_bug.cgi?id=219293
Comment 3 Hugo Mildenberger 2009-12-20 17:07:25 UTC
Created attachment 213582 [details, diff]
patch against kstars/kstars/skyobjects/saturnmoons.cpp

To test it, just add the line 

PATCHES=( "${FILESDIR}/${PV}/saturnmoons-fix-index-and-angle-errors.patch" )

to kstars-4.3.4.ebuild, and put the patch into a newly created "files/4.3.4/" directory.


This patch fixes four things:
 1.) The author assumed C arrays would start with element 1. The
     consequence was a stack smashing "attack" detected when
     compiled with -fstack-protector-all
 2.) summing up angles given in degrees with angles given in radians:
     see double u = 2*W5 - 2*theta + psi;
 3.) remove unnecessary calls to MapTo0To360Range
 4.) remove unused, superflous arrays declarations

HOWEVER: Saturn's moon position still appear to be wrong when
         compared to the output of JPL's solar system simulator 
         for any given date (here: http://space.jpl.nasa.gov/)
Comment 4 Maciej Mrozowski gentoo-dev 2010-01-03 01:45:03 UTC
Thanks for your report - apparently it's been fixed upstream in r1065303 - http://websvn.kde.org/?view=revision&revision=1065303

That code was not only broken, but even "stolen" (and thus it's has been removed).
Comment 5 Samuli Suominen (RETIRED) gentoo-dev 2010-01-27 14:07:04 UTC
This should be included in 4.3.5 as it was fixed in 4.3 branch.