sipcalc crashed with SIGABRT in __libc_message()

Bug #973602 reported by ianand0204
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
sipcalc (Ubuntu)
Fix Released
Medium
Unassigned

Bug Description

*** buffer overflow detected ***: sipcalc terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7f7cfd6b8007]
/lib/x86_64-linux-gnu/libc.so.6(+0x107f00)[0x7f7cfd6b6f00]
/lib/x86_64-linux-gnu/libc.so.6(+0x1075eb)[0x7f7cfd6b65eb]
/lib/x86_64-linux-gnu/libc.so.6(__snprintf_chk+0x78)[0x7f7cfd6b64c8]
sipcalc[0x4077df]
sipcalc[0x4015d8]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7f7cfd5d076d]
sipcalc[0x4017d9]
======= Memory map: ========
00400000-0040a000 r-xp 00000000 fc:00 12325073 /usr/bi
n/sipcalc
0060a000-0060b000 r--p 0000a000 fc:00 12325073 /usr/bi
n/sipcalc
0060b000-0060c000 rw-p 0000b000 fc:00 12325073 /usr/bi
n/sipcalc
0060c000-0060d000 rw-p 00000000 00:00 0
017e1000-01802000 rw-p 00000000 00:00 0 [heap]
7f7cfd399000-7f7cfd3ae000 r-xp 00000000 fc:00 524332 /lib/x8
6_64-linux-gnu/libgcc_s.so.1
7f7cfd3ae000-7f7cfd5ad000 ---p 00015000 fc:00 524332 /lib/x8
6_64-linux-gnu/libgcc_s.so.1
7f7cfd5ad000-7f7cfd5ae000 r--p 00014000 fc:00 524332 /lib/x8
6_64-linux-gnu/libgcc_s.so.1
7f7cfd5ae000-7f7cfd5af000 rw-p 00015000 fc:00 524332 /lib/x8
6_64-linux-gnu/libgcc_s.so.1
7f7cfd5af000-7f7cfd761000 r-xp 00000000 fc:00 524893 /lib/x8
6_64-linux-gnu/libc-2.15.so
7f7cfd761000-7f7cfd961000 ---p 001b2000 fc:00 524893 /lib/x8
6_64-linux-gnu/libc-2.15.so
7f7cfd961000-7f7cfd965000 r--p 001b2000 fc:00 524893 /lib/x8
6_64-linux-gnu/libc-2.15.so
7f7cfd965000-7f7cfd967000 rw-p 001b6000 fc:00 524893 /lib/x8
6_64-linux-gnu/libc-2.15.so
7f7cfd967000-7f7cfd96c000 rw-p 00000000 00:00 0
7f7cfd96c000-7f7cfd98e000 r-xp 00000000 fc:00 524895 /lib/x8
6_64-linux-gnu/ld-2.15.so
7f7cfdb75000-7f7cfdb78000 rw-p 00000000 00:00 0
7f7cfdb8b000-7f7cfdb8e000 rw-p 00000000 00:00 0
7f7cfdb8e000-7f7cfdb8f000 r--p 00022000 fc:00 524895 /lib/x8
6_64-linux-gnu/ld-2.15.so
7f7cfdb8f000-7f7cfdb91000 rw-p 00023000 fc:00 524895 /lib/x8
6_64-linux-gnu/ld-2.15.so
7fff07a3b000-7fff07a5c000 rw-p 00000000 00:00 0 [stack]

7fff07bcb000-7fff07bcc000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsysca
ll]
Aborted (core dumped)

ProblemType: Crash
DistroRelease: Ubuntu 12.04
Package: sipcalc 1.1.4-2.1
ProcVersionSignature: Ubuntu 3.2.0-21.34-generic 3.2.13
Uname: Linux 3.2.0-21-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.0-0ubuntu4
Architecture: amd64
Date: Wed Apr 4 10:36:02 2012
ExecutablePath: /usr/bin/sipcalc
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha amd64 (20120320)
ProcCmdline: sipcalc 10.30.0.0/255.255.0.0
ProcEnviron:
 TERM=screen-256color
 SHELL=/bin/bash
 PATH=(custom, user)
 LANG=en_US.UTF-8
Signal: 6
SourcePackage: sipcalc
Title: sipcalc crashed with SIGABRT in raise()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip fuse kvm libvirtd lpadmin plugdev sambashare sudo

Related branches

Revision history for this message
ianand0204 (ianand0204) wrote :
Revision history for this message
Apport retracing service (apport) wrote : Stacktrace.txt
Revision history for this message
Apport retracing service (apport) wrote : StacktraceTop.txt
Revision history for this message
Apport retracing service (apport) wrote : ThreadStacktrace.txt
Changed in sipcalc (Ubuntu):
importance: Undecided → Medium
summary: - sipcalc crashed with SIGABRT in raise()
+ sipcalc crashed with SIGABRT in __libc_message()
tags: removed: need-amd64-retrace
Revision history for this message
Dave Gilbert (ubuntu-treblig) wrote :

Trivially reproducable with the reporters command line:

sipcalc 10.30.0.0/255.255.0.0

(for me on 1.1.4-2.1)

Medium -> A bug that has a severe impact on a non-core application.

visibility: private → public
Changed in sipcalc (Ubuntu):
status: New → Triaged
tags: added: testcase
Revision history for this message
Dave Gilbert (ubuntu-treblig) wrote :

This is caused because the code that prints an error message tries to snprintf into a 64 character buffer (errorstr) while telling snprintf it's 128 bytes long (the error messages is actually shorter than 64 but I think fortify is getting triggered probably by snprintf 0 terminating the end of the buffer).

Looking at http://www.routemeister.net/projects/sipcalc/download.html verison 1.1.5 (latest - from 2009!) it looks like it is fixed, so while I just cooked a simple patch, it seems probably the best thing would be to update the package to 1.1.5.

Dave

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package sipcalc - 1.1.5-0ubuntu1

---------------
sipcalc (1.1.5-0ubuntu1) precise; urgency=low

  * New upstream release (LP: #973602)
    - drop upstream applied debian/patches/fix_ftbfs.patch
  * use dh_autoreconf and drop configure.{sub,guess} patches
 -- Julian Taylor <email address hidden> Thu, 05 Apr 2012 20:50:47 +0200

Changed in sipcalc (Ubuntu):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.