Ubuntu
horgand package

horgand segfaults at startup (due to buffer overflow)

Bug #891939 reported by David Monniaux on 2011-11-18

This bug affects 2 people

Affects		Status	Importance	Assigned to	Milestone
	horgand (Debian)	Fix Released	Unknown	debbugs #695467
	horgand (Ubuntu)	Fix Released	High	Unassigned

Bug Description

It is impossible to use Horgand at all because it segfaults at startup.

Starting program: /usr/lib/horgand/ /lib/i386-linux-gnu/libc.so.linux-gnu/libc.so.linux-gnu/libc.so.horgand/horgand[horgand/horgand[horgand/horgand[horgand/horgand[horgand/horgand[linux-gnu/libc.so. 00110000-0012e000 r-xp 00000000 08:05 4532513 0012e000-0012f000 r--p 0001d000 08:05 4532513 0012f000-00130000 rw-p 0001e000 08:05 4532513 00130000-00131000 r-xp 00000000 00:00 0 00131000-00262000 r-xp 00000000 08:05 3689916 00262000-00263000 ---p 00131000 08:05 3689916 00263000-00264000 r--p 00131000 08:05 3689916 00264000-00266000 rw-p 00132000 08:05 3689916 00266000-00267000 rw-p 00000000 00:00 0
00267000-00307000 r-xp 00000000 08:05 3691153 00307000-00308000 ---p 000a0000 08:05 3691153 00308000-0030a000 r--p 000a0000 08:05 3691153 0030a000-0030e000 rw-p 000a2000 08:05 3691153 0030e000-00311000 rw-p 00000000 00:00 0
00311000-003fd000 r-xp 00000000 08:05 3708171 003fd000-00401000 r--p 000eb000 08:05 3708171 00401000-00402000 rw-p 000ef000 08:05 3708171 00402000-00441000 r-xp 00000000 08:05 3674464 00441000-00442000 r--p 0003f000 08:05 3674464 00442000-00443000 rw-p 00040000 08:05 3674464 00443000-0045a000 r-xp 00000000 08:05 4532531 0045a000-0045b000 r--p 00016000 08:05 4532531 0045b000-0045c000 rw-p 00017000 08:05 4532531 0045c000-0045e000 rw-p 00000000 00:00 0
0045e000-004c9000 r-xp 00000000 08:05 3705122 004c9000-004ca000 r--p 0006b000 08:05 3705122 004ca000-004cb000 rw-p 0006c000 08:05 3705122 004cb000-004cf000 rw-p 00000000 00:00 0
004cf000-004de000 r-xp 00000000 08:05 3425346 004de000-004df000 r--p 0000e000 08:05 3425346 004df000-004e0000 rw-p 0000f000 08:05 3425346 004e0000-005be000 r-xp 00000000 08:05 3671272 005be000-005bf000 ---p 000de000 08:05 3671272 005bf000-005c3000 r--p 000de000 08:05 3671272 005c3000-005c4000 rw-p 000e2000 08:05 3671272 005c4000-005cb000 rw-p 00000000 00:00 0
005cb000-005e7000 r-xp 00000000 08:05 4532511 005e7000-005e8000 r--p 0001b000 08:05 4532511 005e8000-005e9000 rw-p 0001c000 08:05 4532511 005e9000-0075f000 r-xp 00000000 08:05 4532517 0075f000-00761000 r--p 00176000 08:05 4532517 00761000-00762000 rw-p 00178000 08:05 4532517 00762000-00765000 rw-p 00000000 00:00 0
00765000-00782000 r-xp 00000000 08:05 3689849 00782000-00783000 r--p 0001c000 08:05 3689849 00783000-00784000 rw-p 0001d000 08:05 3689849 00784000-00787000 r-xp 00000000 08:05 4532520 00787000-00788000 r--p 00002000 08:05 4532520 00788000-00789000 rw-p 00003000 08:05 4532520 00789000-0079d000 r-xp 00000000 08:05 3670812 0079d000-0079e000 r--p 00013000 08:05 3670812 0079e000-0079f000 rw-p 00014000 08:05 3670812 0079f000-007d1000 r-xp 00000000 08:05 3683122 007d1000-007d2000 ---p 00032000 08:05 3683122 007d2000-007d3000 r--p 00032000 08:05 3683122 007d3000-007d4000 rw-p 00033000 08:05 3683122 007d4000-007d6000 r-xp 00000000 08:05 3683171 007d6000-007d7000 r--p 00001000 08:05 3683171 007d7000-007d8000 rw-p 00002000 08:05 3683171 007d8000-00800000 r-xp 00000000 08:05 4532521 00800000-00801000 r--p 00028000 08:05 4532521 00801000-00802000 rw-p 00029000 08:05 4532521 00802000-00809000 r-xp 00000000 08:05 4532533 00809000-0080a000 r--p 00006000 08:05 4532533 0080a000-0080b000 rw-p 00007000 08:05 4532533 0080b000-00857000 r-xp 00000000 08:05 3702687 00857000-00858000 r--p 0004b000 08:05 3702687 00858000-00859000 rw-p 0004c000 08:05 3702687 00859000-009bf000 r-xp 00000000 08:05 3686434 009bf000-009d0000 r--p 00165000 08:05 3686434 009d0000-009d1000 rw-p 00176000 08:05 3686434 009d1000-009fa000 r-xp 00000000 08:05 3681123 009fa000-009fb000 r--p 00028000 08:05 3681123 009fb000-009fc000 rw-p 00029000 08:05 3681123 009fc000-00a02000 r-xp 00000000 08:05 3689842 00a02000-00a03000 r--p 00005000 08:05 3689842 00a03000-00a04000 rw-p 00006000 08:05 3689842 00a04000-00a06000 r-xp 00000000 08:05 3679990 00a06000-00a07000 r--p 00001000 08:05 3679990 00a07000-00a08000 rw-p 00002000 08:05 3679990 00a08000-00a0d000 r-xp 00000000 08:05 3682007 00a0d000-00a0e000 r--p 00004000 08:05 3682007 00a0e000-00a0f000 rw-p 00005000 08:05 3682007 00a0f000-00aa0000 r-xp 00000000 08:05 3670729 00aa0000-00aa1000 ---p 00091000 08:05 3670729 00aa1000-00aa5000 r--p 00091000 08:05 3670729 00aa5000-00aa6000 rw-p 00095000 08:05 3670729 00aa6000-00aaf000 r-xp 00000000 08:05 3683135 00aaf000-00ab0000 r--p 00008000 08:05 3683135 00ab0000-00ab1000 rw-p 00009000 08:05 3683135 00ab1000-00ad7000 r-xp 00000000 08:05 4459205 00ad7000-00ad8000 ---p 00026000 08:05 4459205 00ad8000-00ada000 r--p 00026000 08:05 4459205 00ada000-00adb000 rw-p 00028000 08:05 4459205 00adb000-00aec000 r-xp 00000000 08:05 3695635 00aec000-00aed000 r--p 00010000 08:05 3695635 00aed000-00aee000 rw-p 00011000 08:05 3695635 00aee000-00b01000 r-xp 00000000 08:05 4456499 00b01000-00b02000 r--p 00012000 08:05 4456499 00b02000-00b03000 rw-p 00013000 08:05 4456499 08048000-0808a000 r-xp 00000000 08:05 3413830 0808a000-0808b000 r--p 00041000 08:05 3413830 0808b000-0808c000 rw-p 00042000 08:05 3413830 0808c000-080da000 rw-p 00000000 00:00 0 b7fcd000-b7fd6000 rw-p 00000000 00:00 0
b7ffe000-b8000000 rw-p 00000000 00:00 0
bffdf000-c0000000 rw-p 00000000 00:00 0 />horgand
enabled]
/>horgand/horgand terminated
/>6(__fortify_fail+0x45)[0x6d08d5]
/>6(+0xe66d7)[0x6cf6d7]
/>6(+0xe5a0d)[0x6cea0d]
/>0x804d21e]
/>0x804b91f]
/>0x8078bbd]
/>0x804a4e8]
/>0x8078a89]
/>6(__libc_start_main+0x8a)[0x6020aa]
/lib/i386-linux-gnu/ld-2.13.so
/lib/i386-linux-gnu/ld-2.13.so
/lib/i386-linux-gnu/ld-2.13.so
[vdso]
/usr/lib/i386-linux-gnu/libX11.so.6.3.0
/usr/lib/i386-linux-gnu/libX11.so.6.3.0
/usr/lib/i386-linux-gnu/libX11.so.6.3.0
/usr/lib/i386-linux-gnu/libX11.so.6.3.0
/usr/lib/i386-linux-gnu/libfltk.so.1.1
/usr/lib/i386-linux-gnu/libfltk.so.1.1
/usr/lib/i386-linux-gnu/libfltk.so.1.1
/usr/lib/i386-linux-gnu/libfltk.so.1.1
/usr/lib/i386-linux-gnu/libasound.so.2.0.0
/usr/lib/i386-linux-gnu/libasound.so.2.0.0
/usr/lib/i386-linux-gnu/libasound.so.2.0.0
/usr/lib/i386-linux-gnu/libjack.so.0.1.0
/usr/lib/i386-linux-gnu/libjack.so.0.1.0
/usr/lib/i386-linux-gnu/libjack.so.0.1.0
/lib/i386-linux-gnu/libpthread-2.13.so
/lib/i386-linux-gnu/libpthread-2.13.so
/lib/i386-linux-gnu/libpthread-2.13.so
/usr/lib/i386-linux-gnu/libsndfile.so.1.0.24
/usr/lib/i386-linux-gnu/libsndfile.so.1.0.24
/usr/lib/i386-linux-gnu/libsndfile.so.1.0.24
/usr/lib/libXpm.so.4.11.0
/usr/lib/libXpm.so.4.11.0
/usr/lib/libXpm.so.4.11.0
/usr/lib/i386-linux-gnu/libstdc++.so.6.0.16
/usr/lib/i386-linux-gnu/libstdc++.so.6.0.16
/usr/lib/i386-linux-gnu/libstdc++.so.6.0.16
/usr/lib/i386-linux-gnu/libstdc++.so.6.0.16
/lib/i386-linux-gnu/libgcc_s.so.1
/lib/i386-linux-gnu/libgcc_s.so.1
/lib/i386-linux-gnu/libgcc_s.so.1
/lib/i386-linux-gnu/libc-2.13.so
/lib/i386-linux-gnu/libc-2.13.so
/lib/i386-linux-gnu/libc-2.13.so
/usr/lib/i386-linux-gnu/libxcb.so.1.1.0
/usr/lib/i386-linux-gnu/libxcb.so.1.1.0
/usr/lib/i386-linux-gnu/libxcb.so.1.1.0
/lib/i386-linux-gnu/libdl-2.13.so
/lib/i386-linux-gnu/libdl-2.13.so
/lib/i386-linux-gnu/libdl-2.13.so
/usr/lib/i386-linux-gnu/libXft.so.2.2.0
/usr/lib/i386-linux-gnu/libXft.so.2.2.0
/usr/lib/i386-linux-gnu/libXft.so.2.2.0
/usr/lib/i386-linux-gnu/libfontconfig.so.1.4.4
/usr/lib/i386-linux-gnu/libfontconfig.so.1.4.4
/usr/lib/i386-linux-gnu/libfontconfig.so.1.4.4
/usr/lib/i386-linux-gnu/libfontconfig.so.1.4.4
/usr/lib/i386-linux-gnu/libXinerama.so.1.0.0
/usr/lib/i386-linux-gnu/libXinerama.so.1.0.0
/usr/lib/i386-linux-gnu/libXinerama.so.1.0.0
/lib/i386-linux-gnu/libm-2.13.so
/lib/i386-linux-gnu/libm-2.13.so
/lib/i386-linux-gnu/libm-2.13.so
/lib/i386-linux-gnu/librt-2.13.so
/lib/i386-linux-gnu/librt-2.13.so
/lib/i386-linux-gnu/librt-2.13.so
/usr/lib/i386-linux-gnu/libFLAC.so.8.2.0
/usr/lib/i386-linux-gnu/libFLAC.so.8.2.0
/usr/lib/i386-linux-gnu/libFLAC.so.8.2.0
/usr/lib/i386-linux-gnu/libvorbisenc.so.2.0.8
/usr/lib/i386-linux-gnu/libvorbisenc.so.2.0.8
/usr/lib/i386-linux-gnu/libvorbisenc.so.2.0.8
/usr/lib/i386-linux-gnu/libvorbis.so.0.4.5
/usr/lib/i386-linux-gnu/libvorbis.so.0.4.5
/usr/lib/i386-linux-gnu/libvorbis.so.0.4.5
/usr/lib/i386-linux-gnu/libogg.so.0.7.1
/usr/lib/i386-linux-gnu/libogg.so.0.7.1
/usr/lib/i386-linux-gnu/libogg.so.0.7.1
/usr/lib/i386-linux-gnu/libXau.so.6.0.0
/usr/lib/i386-linux-gnu/libXau.so.6.0.0
/usr/lib/i386-linux-gnu/libXau.so.6.0.0
/usr/lib/i386-linux-gnu/libXdmcp.so.6.0.0
/usr/lib/i386-linux-gnu/libXdmcp.so.6.0.0
/usr/lib/i386-linux-gnu/libXdmcp.so.6.0.0
/usr/lib/i386-linux-gnu/libfreetype.so.6.6.2
/usr/lib/i386-linux-gnu/libfreetype.so.6.6.2
/usr/lib/i386-linux-gnu/libfreetype.so.6.6.2
/usr/lib/i386-linux-gnu/libfreetype.so.6.6.2
/usr/lib/i386-linux-gnu/libXrender.so.1.3.0
/usr/lib/i386-linux-gnu/libXrender.so.1.3.0
/usr/lib/i386-linux-gnu/libXrender.so.1.3.0
/lib/i386-linux-gnu/libexpat.so.1.5.2
/lib/i386-linux-gnu/libexpat.so.1.5.2
/lib/i386-linux-gnu/libexpat.so.1.5.2
/lib/i386-linux-gnu/libexpat.so.1.5.2
/usr/lib/i386-linux-gnu/libXext.so.6.4.0
/usr/lib/i386-linux-gnu/libXext.so.6.4.0
/usr/lib/i386-linux-gnu/libXext.so.6.4.0
/lib/i386-linux-gnu/libz.so.1.2.3.4
/lib/i386-linux-gnu/libz.so.1.2.3.4
/lib/i386-linux-gnu/libz.so.1.2.3.4
/usr/lib/horgand/horgand
/usr/lib/horgand/horgand
/usr/lib/horgand/horgand
[heap]
[stack]

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: horgand 1.14-4
ProcVersionSignature: Ubuntu 3.0.0-12.20-generic 3.0.4-ehci_hcd-lowlatency-hostname
Uname: Linux 3.0.4-ehcihcd-lowlatency-etale i686
NonfreeKernelModules: wl
ApportVersion: 1.23-0ubuntu4
Architecture: i386
Date: Fri Nov 18 07:14:39 2011
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release i386 (20100429)
ProcEnviron:
PATH=(custom, user)
LANG=en_US.UTF-8
SHELL=/bin/bash
SourcePackage: horgand
UpgradeStatus: Upgraded to oneiric on 2011-10-15 (33 days ago)

Tags:

Related branches

lp:debian/horgand

Revision history for this message

David Monniaux (david-monniaux) wrote on 2011-11-18:

Dependencies.txt Edit (1.2 KiB, text/plain; charset="utf-8")

Revision history for this message

Hans Joachim Desserud (hjd) wrote on 2011-11-19:

I get a similar error message when attempting to run horgand on Ubuntu 11.10.

Changed in horgand (Ubuntu):
status:	New → Confirmed

Revision history for this message

David Monniaux (david-monniaux) wrote on 2012-07-29:

Problem also occurs if I compile Horgand myself.

Revision history for this message

Hans Joachim Desserud (hjd) wrote on 2012-12-08:

This issue is still present on Ubuntu Raring (and presumably the versions in between). Horgand starts without any problems on my Debian Sid system though, so this might be an Ubuntu-specific issue somehow.

tags:	added: precise quantal raring
summary:	- horgand segfaults + horgand segfaults at startup (due to buffer overflow)

Revision history for this message

Dave Gilbert (ubuntu-treblig) wrote on 2012-12-08:

High (dead on startup) - set for hjd

Changed in horgand (Ubuntu):
importance:	Undecided → High

Revision history for this message

Dave Gilbert (ubuntu-treblig) wrote on 2012-12-08:

#5 0x00000000004066f7 in strcpy (__src=0x430ed0 "m(Maj7)(b5)", __dest=0x65dd00 <hor+105536> "")
    at /usr/include/x86_64-linux-gnu/bits/string3.h:104
No locals.
#6 HOR::HOR (this=0x6440c0 <hor>) at organ.C:633
        tapsg = {36, 33, 29, 27, 24, 21, 17, 15, 13, 16, 21, 24, 27, 31, 33, 36}
        sizesin = <optimised out>
        x_sin = <optimised out>
        tcombl = {10586, 12340, 6400, 13100, 8004, 7200, 5130, 9037, 12045, 11237, 9456, 7634, 5389, 8056, 10120, 11432}
        tcombr = {10518, 11340, 8450, 11100, 9644, 7560, 9536, 11507, 12600, 11111, 8056, 6048, 7690, 5978, 8845, 10056}

that's:

633 strcpy(Chord4[45].Nom,"m(Maj7)(b5)");

and Chord4 is:
struct Ch4

{
  char Nom[10];
  int type;
  int fund;
  int dist1;
  int dist2;
  int dist3;
} Chord4[50];

so trying to copy a 10char+nil into a 10char buffer - KABOOM!

Changed in horgand (Ubuntu):
status:	Confirmed → Triaged

Revision history for this message

Dave Gilbert (ubuntu-treblig) wrote on 2012-12-08:

Fix nom length in Chord4 Edit (493 bytes, text/plain)

OK, here's a patch that gets past the overflow; I think it's safe; there are a LOT of fixed length string buffers in the
code. This stretches this 10 char to 12 char to fit the string being copied in; there are places that append that string
into others in other bits of the code, but I *think* they're big enough.

Having said that, I can't get it to run, it's failing to open the plughw:0,0 audio device for me.

Upstream looks pretty dead.

Dave

Bug Watch Updater (bug-watch-updater) on 2012-12-08

Changed in horgand (Debian):
status:	Unknown → New

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2012-12-08:

The attachment "Fix nom length in Chord4" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-reviewers team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

tags:

added: patch

Revision history for this message

Dave Gilbert (ubuntu-treblig) wrote on 2013-01-01:

Thanks to Steve Cotton pointing out the reason it wouldn't run was just contention on the audio device; with PA suspended and my patch it runs fine.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2013-01-03:

#10

This bug was fixed in the package horgand - 1.14-5

---------------
horgand (1.14-5) unstable; urgency=medium

  * Prevent SIGSEGV by fixing a buffer overflow, it was tryng to
    strcpy() of an 11 char string (+ '\0') into a 10 char fixed
    array. (Closes: #695467) (LP: #891939)

-- Alessio Treglia <email address hidden> Wed, 02 Jan 2013 14:06:58 +0000