axcall crashes on connect when SSID is 10 to 15

[Wietse Ruyg]

For example, a netrom connect to a callsign with ssid 10. With ax25 port it crashes too.

axcall netrom pi8rwd-10

GW4PTS AX.25 Connect v1.11
*** Connected to PI8RWD-10
*** buffer overflow detected ***: axcall terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7f85254cb807]
/lib/x86_64-linux-gnu/libc.so.6(+0x109700)[0x7f85254ca700]
/lib/x86_64-linux-gnu/libc.so.6(+0x108b69)[0x7f85254c9b69]
/lib/x86_64-linux-gnu/libc.so.6(_IO_default_xsputn+0xdd)[0x7f852543d13d]
/lib/x86_64-linux-gnu/libc.so.6(_IO_vfprintf+0x1ae7)[0x7f852540b4a7]
/lib/x86_64-linux-gnu/libc.so.6(__vsprintf_chk+0x94)[0x7f85254c9c04]
/lib/x86_64-linux-gnu/libc.so.6(__sprintf_chk+0x7d)[0x7f85254c9b4d]
axcall[0x403e0f]
axcall[0x405eb0]
axcall[0x406fd7]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xed)[0x7f85253e276d]
axcall[0x4026b9]
======= Memory map: ========
00400000-0040c000 r-xp 00000000 08:02 423826 /usr/bin/axcall
0060b000-0060c000 r--p 0000b000 08:02 423826 /usr/bin/axcall
0060c000-0060d000 rw-p 0000c000 08:02 423826 /usr/bin/axcall
0060d000-0060e000 rw-p 00000000 00:00 0
0244b000-0246c000 rw-p 00000000 00:00 0 [heap]
7f8524d80000-7f8524d95000 r-xp 00000000 08:02 262188 /lib/x86_64-linux-gnu/libgcc_s.so.1
7f8524d95000-7f8524f94000 ---p 00015000 08:02 262188 /lib/x86_64-linux-gnu/libgcc_s.so.1
7f8524f94000-7f8524f95000 r--p 00014000 08:02 262188 /lib/x86_64-linux-gnu/libgcc_s.so.1
7f8524f95000-7f8524f96000 rw-p 00015000 08:02 262188 /lib/x86_64-linux-gnu/libgcc_s.so.1
7f8524f96000-7f8524fb8000 r-xp 00000000 08:02 262212 /lib/x86_64-linux-gnu/libtinfo.so.5.9
7f8524fb8000-7f85251b8000 ---p 00022000 08:02 262212 /lib/x86_64-linux-gnu/libtinfo.so.5.9
7f85251b8000-7f85251bc000 r--p 00022000 08:02 262212 /lib/x86_64-linux-gnu/libtinfo.so.5.9
7f85251bc000-7f85251bd000 rw-p 00026000 08:02 262212 /lib/x86_64-linux-gnu/libtinfo.so.5.9
7f85251bd000-7f85251bf000 r-xp 00000000 08:02 262174 /lib/x86_64-linux-gnu/libdl-2.15.so
7f85251bf000-7f85253bf000 ---p 00002000 08:02 262174 /lib/x86_64-linux-gnu/libdl-2.15.so
7f85253bf000-7f85253c0000 r--p 00002000 08:02 262174 /lib/x86_64-linux-gnu/libdl-2.15.so
7f85253c0000-7f85253c1000 rw-p 00003000 08:02 262174 /lib/x86_64-linux-gnu/libdl-2.15.so
7f85253c1000-7f8525576000 r-xp 00000000 08:02 262176 /lib/x86_64-linux-gnu/libc-2.15.so
7f8525576000-7f8525775000 ---p 001b5000 08:02 262176 /lib/x86_64-linux-gnu/libc-2.15.so
7f8525775000-7f8525779000 r--p 001b4000 08:02 262176 /lib/x86_64-linux-gnu/libc-2.15.so
7f8525779000-7f852577b000 rw-p 001b8000 08:02 262176 /lib/x86_64-linux-gnu/libc-2.15.so
7f852577b000-7f8525780000 rw-p 00000000 00:00 0
7f8525780000-7f8525788000 r-xp 00000000 08:02 423090 /usr/lib/libax25.so.0.0.0
7f8525788000-7f8525987000 ---p 00008000 08:02 423090 /usr/lib/libax25.so.0.0.0
7f8525987000-7f8525988000 r--p 00007000 08:02 423090 /usr/lib/libax25.so.0.0.0
7f8525988000-7f8525989000 rw-p 00008000 08:02 423090 /usr/lib/libax25.so.0.0.0
7f8525989000-7f85259a8000 r-xp 00000000 08:02 262208 /lib/x86_64-linux-gnu/libncurses.so.5.9
7f85259a8000-7f8525ba8000 ---p 0001f000 08:02 262208 /lib/x86_64-linux-gnu/libncurses.so.5.9
7f8525ba8000-7f8525ba9000 r--p 0001f000 08:02 262208 /lib/x86_64-linux-gnu/libncurses.so.5.9
7f8525ba9000-7f8525baa000 rw-p 00020000 08:02 262208 /lib/x86_64-linux-gnu/libncurses.so.5.9
7f8525baa000-7f8525bcc000 r-xp 00000000 08:02 262193 /lib/x86_64-linux-gnu/ld-2.15.so
7f8525dad000-7f8525db1000 rw-p 00000000 00:00 0
7f8525dc8000-7f8525dcc000 rw-p 00000000 00:00 0
7f8525dcc000-7f8525dcd000 r--p 00022000 08:02 262193 /lib/x86_64-linux-gnu/ld-2.15.so
7f8525dcd000-7f8525dcf000 rw-p 00023000 08:02 262193 /lib/x86_64-linux-gnu/ld-2.15.so
7fffe8021000-7fffe8042000 rw-p 00000000 00:00 0 [stack]
7fffe81bc000-7fffe81bd000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Aborted (core dumped)

lsb_release -rd:

Description: Ubuntu 12.04.1 LTS
Release: 12.04

apt-cache policy ax25-apps:

ax25-apps:
  Installed: 0.0.6-16.2
  Candidate: 0.0.6-16.2
  Version table:
 *** 0.0.6-16.2 0
        500 http://nl.archive.ubuntu.com/ubuntu/ precise/universe amd64 Packages
        100 /var/lib/dpkg/status

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: ax25-apps 0.0.6-16.2
ProcVersionSignature: Ubuntu 3.2.0-32.51-generic 3.2.30
Uname: Linux 3.2.0-32-generic x86_64
ApportVersion: 2.0.1-0ubuntu14
Architecture: amd64
Date: Sat Oct 27 22:00:30 2012
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64 (20120425)
SourcePackage: ax25-apps
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Brian Smith (avalon73)]

The problem isn't one of not handling SSIDs larger than 9, but of handling call+SSID strings longer than 8 characters, and the culprit is in the start_screen function in call.c. I expanded the string buffer and string format to accomodate a 9-character call+SSID combination, which should be plenty as AX.25 specifies a 6-character call sign. The change doesn't appear to cause any problems with the UI, and I didn't get any other crashes when connecting to a node that I had problems with previously (one of our local Winlink 2000 FM packet nodes),

This patch is really just a quick diff from the axcall source code directory, so it'll need some tweaking before it can be applied directly.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "call.c.patch_avalon73" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-reviewers team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

[Brian Smith (avalon73)]

This was also fixed upstream, 4 weeks ago.

http://www.linux-ax25.org/cvsweb/ax25-apps/call/call.c.diff?r1=1.25;r2=1.26;f=h

[François Marier (fmarier)]

I suspect this was solved a while back since 0.0.10 is what's been in Ubuntu for a long time now. Please reopen if that's not the case.

[François Marier (fmarier)]

Sorry for pasting the wrong version number in my last comment. I meant to point out that 0.0.8-rc2+cvs20130510-3 in Trusty would have included that upstream patch.