Bug 95612

Description Vasil Dimov 2006-04-11 07:40:13 UTC

# ngrep
Segmentation fault: 11 (core dumped)
#

# gdb ./ngrep
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...
(gdb) r
Starting program: /usr/ports/net/ngrep/work/ngrep-1.44/ngrep

Program received signal SIGSEGV, Segmentation fault.
0x0000000800823ed0 in strlen () from /lib/libc.so.6
(gdb) bt
#0  0x0000000800823ed0 in strlen () from /lib/libc.so.6
#1  0x0000000800821521 in __vfprintf () from /lib/libc.so.6
#2  0x000000080082225f in vfprintf () from /lib/libc.so.6
#3  0x000000080080f09a in printf () from /lib/libc.so.6
#4  0x0000000000401f5d in main (argc=1, argv=0x7fffffffeab0) at ngrep.c:355
(gdb) f 4
#4  0x0000000000401f5d in main (argc=1, argv=0x7fffffffeab0) at ngrep.c:355
355                     printf(" (%s/", inet_ntoa(net));
(gdb) l
350             }
351
352             if (quiet < 2) {
353                 printf("interface: %s", dev);
354                 if (net.s_addr && mask.s_addr) {
355                     printf(" (%s/", inet_ntoa(net));
356                     printf("%s)", inet_ntoa(mask));
357                 }
358                 printf("\n");
359             }
(gdb) ins net
$1 = {s_addr = 698560}
(gdb)

So inet_ntoa(net) returns something bogus.

If I modify the code like this:
            char *n;
            n = inet_ntoa(net);
            if (net.s_addr && mask.s_addr) {
                printf(" (%s/", n);
then I get this warning during compilation:

ngrep.c:355: warning: assignment makes pointer from integer without a cast

and gdb shows the following:
...
Program received signal SIGSEGV, Segmentation fault.
0x0000000800823ed0 in strlen () from /lib/libc.so.6
(gdb) f 4
#4  0x0000000000401f65 in main (argc=1, argv=0x7fffffffeab0) at ngrep.c:357
357                     printf(" (%s/", n);
(gdb) ins n
$1 = 0x951530 <Error reading address 0x951530: Bad address>
(gdb)

Fix: Include the appropriate headers as documented in inet_ntoa(3):
http://www.freebsd.org/cgi/man.cgi?query=inet_ntoa



-- 
Vasil Dimov
gro.DSBeerF@dv

Testing can show the presence of bugs, but not their absence.
                -- Edsger W. Dijkstra--0WMuYOD4Xu6P0K7IeNb3BhLADzNyVdOD6YF6gGOueOaWP8f2
Content-Type: text/plain; name="patch-ngrep.c"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="patch-ngrep.c"

--- ngrep.c.orig	Tue Apr 11 09:20:31 2006
+++ ngrep.c	Tue Apr 11 09:20:59 2006
@@ -15,6 +15,7 @@
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <net/if.h>
+#include <arpa/inet.h>
 #include <sys/tty.h>
 #include <pwd.h>
 #endif
How-To-Repeat: 
Just start ngrep on amd64