double free or corruption in siege

Bug #67553 reported by Per Buer
32
Affects Status Importance Assigned to Milestone
siege (Ubuntu)
Fix Released
Undecided
ville palo

Bug Description

Running siege with default config on i686:

perbu@pad:~$ siege http://localhost/ &> foo
*** glibc detected *** siege: double free or corruption (out): 0x0805c1e8 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb7c978bd]
/lib/tls/i686/cmov/libc.so.6(__libc_free+0x84)[0xb7c97a44]
siege[0x80549bd]
siege[0x805421f]
siege[0x8054388]
siege[0x8051489]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xdc)[0xb7c468cc]
siege[0x804a461]
======= Memory map: ========
08048000-08058000 r-xp 00000000 08:02 855192 /usr/bin/siege
08058000-08059000 rw-p 0000f000 08:02 855192 /usr/bin/siege
08059000-0807d000 rw-p 08059000 00:00 0 [heap]
b0300000-b0321000 rw-p b0300000 00:00 0
b0321000-b0400000 ---p b0321000 00:00 0
b0402000-b040c000 r-xp 00000000 08:02 66557 /lib/libgcc_s.so.1
b040d000-b040e000 ---p b040d000 00:00 0
b040e000-b0c0e000 rw-p b040e000 00:00 0
b0c0e000-b0c0f000 ---p b0c0e000 00:00 0
b0c0f000-b140f000 rw-p b0c0f000 00:00 0
b140f000-b1410000 ---p b140f000 00:00 0
b1410000-b1c10000 rw-p b1410000 00:00 0
b1c10000-b1c11000 ---p b1c10000 00:00 0
b1c11000-b2411000 rw-p b1c11000 00:00 0
b2411000-b2412000 ---p b2411000 00:00 0
b2412000-b2c12000 rw-p b2412000 00:00 0
b2c12000-b2c13000 ---p b2c12000 00:00 0
b2c13000-b3413000 rw-p b2c13000 00:00 0
b3413000-b3414000 ---p b3413000 00:00 0
b3414000-b3c14000 rw-p b3414000 00:00 0
b3c14000-b3c15000 ---p b3c14000 00:00 0
b3c15000-b4415000 rw-p b3c15000 00:00 0
b4415000-b4416000 ---p b4415000 00:00 0
b4416000-b4c16000 rw-p b4416000 00:00 0
b4c16000-b4c17000 ---p b4c16000 00:00 0
b4c17000-b5417000 rw-p b4c17000 00:00 0
b5417000-b5418000 ---p b5417000 00:00 0
b5418000-b5c18000 rw-p b5418000 00:00 0
b5c18000-b5c19000 ---p b5c18000 00:00 0
b5c19000-b6419000 rw-p b5c19000 00:00 0
b6419000-b641a000 ---p b6419000 00:00 0
b641a000-b6c1a000 rw-p b641a000 00:00 0
b6c1a000-b6c1b000 ---p b6c1a000 00:00 0
b6c1b000-b741b000 rw-p b6c1b000 00:00 0
b741b000-b741c000 ---p b741b000 00:00 0
b741c000-b7c1d000 rw-p b741c000 00:00 0
b7c1d000-b7c30000 r-xp 00000000 08:02 847893 /usr/lib/libz.so.1.2.3
b7c30000-b7c31000 rw-p 00012000 08:02 847893 /usr/lib/libz.so.1.2.3
b7c31000-b7d5e000 r-xp 00000000 08:02 65373 /lib/tls/i686/cmov/libc-2.4.so
b7d5e000-b7d60000 r--p 0012c000 08:02 65373 /lib/tls/i686/cmov/libc-2.4.so
b7d60000-b7d62000 rw-p 0012e000 08:02 65373 /lib/tls/i686/cmov/libc-2.4.so
b7d62000-b7d65000 rw-p b7d62000 00:00 0
b7d65000-b7e87000 r-xp 00000000 08:02 863878 /usr/lib/i686/cmov/libcrypto.so.0.9.8
b7e87000-b7e9c000 rw-p 00121000 08:02 863878 /usr/lib/i686/cmov/libcrypto.so.0.9.8
b7e9c000-b7e9f000 rw-p b7e9c000 00:00 0
b7e9f000-b7eda000 r-xp 00000000 08:02 863879 /usr/lib/i686/cmov/libssl.so.0.9.8
b7eda000-b7ede000 rw-p 0003b000 08:02 863879 /usr/lib/i686/cmov/libssl.so.0.9.8
b7ede000-b7edf000 rw-p b7ede000 00:00 0
b7edf000-b7ee1000 r-xp 00000000 08:02 65379 /lib/tls/i686/cmov/libdl-2.4.so
b7ee1000-b7ee3000 rw-p 00001000 08:02 65379 /lib/tls/i686/cmov/libdl-2.4.so
b7ee3000-b7ef2000 r-xp 00000000 08:02 65423 /lib/tls/i686/cmov/libpthread-2.4.so
b7ef2000-b7ef4000 rw-p 0000f000 08:02 65423 /lib/tls/i686/cmov/libpthread-2.4.so
b7ef4000-b7ef6000 rw-p b7ef4000 00:00 0
b7f04000-b7f06000 rw-p b7f04000 00:00 0
b7f06000-b7f1f000 r-xp 00000000 08:02 65349 /lib/ld-2.4.so
b7f1f000-b7f21000 rw-p 00018000 08:02 65349 /lib/ld-2.4.so
bffe8000-bfffe000 rw-p bffe8000 00:00 0 [stack]
ffffe000-fffff000 ---p 00000000 00:00 0 [vdso]
Aborted (core dumped)

Revision history for this message
Per Buer (perbu) wrote :

Attached a relevant core dump.

Revision history for this message
Paolo Sammicheli (xdatap1) wrote :

on my edgy too:

$ siege -V
siege 2.65b1
$ siege -u launchpad.net
*** glibc detected *** siege: munmap_chunk(): invalid pointer: 0x0805c1e5 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__libc_free+0x18a)[0xb7d43b4a]
siege[0x80549bd]
siege[0x805421f]
siege[0x8054388]
siege[0x8051489]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xdc)[0xb7cf28cc]
siege[0x804a461]
======= Memory map: ========
08048000-08058000 r-xp 00000000 03:05 52684 /usr/bin/siege
08058000-08059000 rw-p 0000f000 03:05 52684 /usr/bin/siege
08059000-0807d000 rw-p 08059000 00:00 0 [heap]
<SNIP>

Changed in siege:
status: Unconfirmed → Confirmed
Revision history for this message
ville palo (vi64pa) wrote :

Here's a patch for this.
This part:
- memset(&line, 0, sizeof(line));
+ memset(line, 0, len);

is from debian unstable version and fixes debian bug:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=385295

Revision history for this message
ville palo (vi64pa) wrote :

Feisty has newer version of siege. Segfault doesn't happen anymore on feisty. Marking this as Fix Released.

siege (2.65-3) unstable; urgency=medium

  * Applied patch provided by Christian Aichinger and Michael Ablassmeier.
    Closes: #385295.

 -- Ryszard Lach <email address hidden> Wed, 27 Sep 2006 08:15:40 +0200

Changed in siege:
status: Confirmed → Fix Released
Revision history for this message
ville palo (vi64pa) wrote :

Changed back to fix committed because of SRU bug #74668

Changed in siege:
assignee: nobody → vi64pa
status: Fix Released → Fix Committed
Revision history for this message
ville palo (vi64pa) wrote :

fixed siege version (2.65-2ubuntu1~proposed1) is now in edgy proposed repository. Please, test it and if you find it working please add a "works for me" comment to SRU request Bug #74668

Revision history for this message
Wouter Stomp (wouterstomp-deactivatedaccount) wrote :

SRU was accepted; set to fix released.

Changed in siege:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.