crash if select crafty engine

[Oleg Cherkasov]

Selecting crafty engine to play with default parameters makes eboard crash immediately:

*** buffer overflow detected ***: eboard terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7fc31007d08c]
/lib/x86_64-linux-gnu/libc.so.6(+0x111020)[0x7fc31007c020]
/lib/x86_64-linux-gnu/libc.so.6(+0x11072b)[0x7fc31007b72b]
/lib/x86_64-linux-gnu/libc.so.6(__snprintf_chk+0x78)[0x7fc31007b608]
eboard[0x468a7a]
eboard[0x468770]
eboard[0x43e9c1]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(g_closure_invoke+0x138)[0x7fc311088188]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(+0x21b1d)[0x7fc311099b1d]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(g_signal_emit_valist+0xde9)[0x7fc3110a1829]
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0(g_signal_emit+0x82)[0x7fc3110a1ae2]
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0(+0x9dca8)[0x7fc30ec0eca8]
/usr/lib/x86_64-linux-gnu/libgio-2.0.so.0(+0xbcb11)[0x7fc30ec2db11]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_context_dispatch+0x146)[0x7fc310dbf3b6]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(+0x48708)[0x7fc310dbf708]
/lib/x86_64-linux-gnu/libglib-2.0.so.0(g_main_loop_run+0x6a)[0x7fc310dbfb0a]
/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0(gtk_main+0xa7)[0x7fc3118f2277]
eboard[0x40a650]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7fc30ff8cde5]
eboard[0x40ad05]
======= Memory map: ========
00400000-004af000 r-xp 00000000 08:01 25935 /usr/games/eboard
006af000-006b0000 r--p 000af000 08:01 25935 /usr/games/eboard
006b0000-006b9000 rw-p 000b0000 08:01 25935 /usr/games/eboard
006b9000-006bd000 rw-p 00000000 00:00 0
010e9000-01572000 rw-p 00000000 00:00 0 [heap]
7fc2ec000000-7fc2ec022000 rw-p 00000000 00:00 0
7fc2ec022000-7fc2f0000000 ---p 00000000 00:00 0
7fc2f4000000-7fc2f4021000 rw-p 00000000 00:00 0
7fc2f4021000-7fc2f8000000 ---p 00000000 00:00 0
7fc2f8000000-7fc2f8022000 rw-p 00000000 00:00 0
7fc2f8022000-7fc2fc000000 ---p 00000000 00:00 0
7fc2fc000000-7fc2fc022000 rw-p 00000000 00:00 0
7fc2fc022000-7fc300000000 ---p 00000000 00:00 0
7fc301344000-7fc3013c4000 rw-s 00000000 00:04 6586389 /SYSV00000000 (deleted)
7fc3013c4000-7fc30146d000 r--p 00000000 08:01 443620 /usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf
7fc30146d000-7fc30146e000 ---p 00000000 00:00 0
7fc30146e000-7fc301c6e000 rw-p 00000000 00:00 0 [stack:4846]
7fc301c6e000-7fc301c6f000 ---p 00000000 00:00 0
7fc301c6f000-7fc30246f000 rw-p 00000000 00:00 0
7fc30246f000-7fc302470000 ---p 00000000 00:00 0
7fc302470000-7fc302c70000 rw-p 00000000 00:00 0 [stack:4844]
7fc302c70000-7fc302c80000 r-xp 00000000 08:01 262771 /lib/x86_64-linux-gnu/libudev.so.1.3.5
7fc302c80000-7fc302e7f000 ---p 00010000 08:01 262771 /lib/x86_64-linux-gnu/libudev.so.1.3.5
7fc302e7f000-7fc302e80000 r--p 0000f000 08:01 262771 /lib/x86_64-linux-gnu/libudev.so.1.3.5
7fc302e80000-7fc302e81000 rw-p 00010000 08:01 262771 /lib/x86_64-linux-gnu/libudev.so.1.3.5
7fc302e81000-7fc302eb5000 r-xp 00000000 08:01 267321 /usr/lib/x86_64-linux-gnu/gvfs/libgvfscommon.so
7fc302eb5000-7fc3030b5000 ---p 00034000 08:01 267321 /usr/lib/x86_64-linux-gnu/gvfs/libgvfscommon.so
7fc3030b5000-7fc3030ba000 r--p 00034000 08:01 267321 /usr/lib/x86_64-linux-gnu/gvfs/libgvfscommon.so
7fc3030ba000-7fc3030bb000 rw-p 00039000 08:01 267321 /usr/lib/x86_64-linux-gnu/gvfs/libgvfscommon.so
7fc3030bb000-7fc3030ea000 r-xp 00000000 08:01 267317 /usr/lib/x86_64-linux-gnu/gio/modules/libgvfsdbus.so
7fc3030ea000-7fc3032ea000 ---p 0002f000 08:01 267317 /usr/lib/x86_64-linux-gnu/gio/modules/libgvfsdbus.so
7fc3032ea000-7fc3032eb000 r--p 0002f000 08:01 267317 /usr/lib/x86_64-linux-gnu/gio/modules/libgvfsdbus.so
7fc3032eb000-7fc3032ec000 rw-p 00030000 08:01 267317 /usr/lib/x86_64-linux-gnu/gio/modules/libgvfsdbus.so
7fc3032ec000-7fc3032ed000 rw-p 00000000 00:00 0
7fc3032ed000-7fc303340000 r-xp 00000000 08:01 4961 /usr/lib/x86_64-linux-gnu/libibus-1.0.so.5.0.503
7fc303340000-7fc30353f000 ---p 00053000 08:01 4961 /usr/lib/x86_64-linux-gnu/libibus-1.0.so.5.0.503
7fc30353f000-7fc303541000 r--p 00052000 08:01 4961 /usr/lib/x86_64-linux-gnu/libibus-1.0.so.5.0.503
7fc303541000-7fc303542000 rw-p 00054000 08:01 4961 /usr/lib/x86_64-linux-gnu/libibus-1.0.so.5.0.503
7fc303542000-7fc303543000 rw-p 00000000 00:00 0
7fc303543000-7fc303549000 r-xp 00000000 08:01 263004 /usr/lib/x86_64-linux-gnu/gtk-2.0/2.10.0/immodules/im-ibus.so
7fc303549000-7fc303748000 ---p 00006000 08:01 263004 /usr/lib/x86_64-linux-gnu/gtk-2.0/2.10.0/immodules/im-ibus.so
7fc303748000-7fc303749000 r--p 00005000 08:01 263004 /usr/lib/x86_64-linux-gnu/gtk-2.0/2.10.0/immodules/im-ibus.so
7fc303749000-7fc30374a000 rw-p 00006000 08:01 263004 /usr/lib/x86_64-linux-gnu/gtk-2.0/2.10.0/immodules/im-ibus.so
7fc30374a000-7fc3037ff000 r--p 00000000 08:01 443619 /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf
7fc3037ff000-7fc303800000 ---p 00000000 00:00 0
7fc303800000-7fc304000000 rw-p 00000000 00:00 0 [stack:4842]
7fc304000000-7fc304021000 rw-p 00000000 00:00 0
7fc304021000-7fc308000000 ---p 00000000 00:00 0
7fc308046000-7fc308098000 r--p 00000000 08:01 443621 /usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf
7fc308098000-7fc3080ef000 r--p 00000000 08:01 424781 /usr/share/fonts/truetype/ubuntu-font-family/Ubuntu-R.ttf
7fc3080ef000-7fc3080fa000 r--s 00000000 08:15 138279 /var/cache/fontconfig/945677eb7aeaf62f1d50efc3fb3ec7d8-le64.cache-4
7fc3080fa000-7fc308100000 r--s 00000000 08:15 142043 /var/cache/fontconfig/2cd17615ca594fa2959ae173292e504c-le64.cache-4
7fc308100000-7fc308107000 r--s 00000000 08:15 137895 /var/cache/fontconfig/a755afe4a08bf5b97852ceb7400b47bc-le64.cache-4
7fc308107000-7fc308113000 r--s 00000000 08:15 137893 /var/cache/fontconfig/6d41288fd70b0be22e8c3a91e032eec0-le64.cache-4
7fc308113000-7fc308127000 r--s 00000000 08:15 133549 /var/cache/fontconfig/04aabc0a78ac019cf9454389977116d2-le64.cache-4
7fc308188000-7fc3081e8000 rw-s 00000000 00:04 6455316 /SYSV00000000 (deleted)
7fc3081e8000-7fc3081ee000 r-xp 00000000 08:01 267636 /usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-xpm.sozsh: abort (core dumped) eboard

[Oleg Cherkasov (o1e9)]

Ubuntu 13.10

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Stan Wojnowski (wojowhiskey)]

what is a buffer overflow, what causes it, what needs to be found to eliminate it, and how can it be remediated?

[Lars Streblow (lars-streblow)]

I had the same issue at Ubuntu 14.04. When chosen crafty in eboard via default menu item, eboard crashed immediately after starting the game. Starting crafty with generic game option worked without problems.
Checking out the source code I found a problem in the proto_xboard.cc file in the CraftyProtocol::readDialog() function:
You can find
  if (!global.env.Home.empty())
    snprintf(EngineRunDir,512,"%s/.eboard/craftylog",global.env.Home.c_str());
  else
    strcpy(EngineRunDir,"/tmp");
but should use
  if (!global.env.Home.empty())
    snprintf(EngineRunDir,256,"%s/.eboard/craftylog",global.env.Home.c_str());
  else
    strcpy(EngineRunDir,"/tmp");
A directory path shouldn't exceed a length of 260 characters (minus 3 characters for Windows drive letter, e.g. "C:\" and a final "\0" null character), I've read. So change that in the proto_xboard.cc file and make the executable by yourself.
By the way: the configure script doesn't use the paths Ubuntu uses, so adapt them to the Ubuntu paths (see attached configure script)

[Oleg Cherkasov (o1e9)]

Thank you for the patch! Would you propose it as a fix to official Ubuntu repos?

[Lars Streblow (lars-streblow)]

Am 08.04.2015 um 11:30 schrieb Oleg Cherkasov:
> Thank you for the patch! Would you propose it as a fix to official
> Ubuntu repos?
>
Dear Oleg,

of course I would like to have this bug fixed officially. Do I have to
do something for it or would you arrange all things, that are necessary
for this (changing source, building binaries or something like that)?

I've reviewed the code of proto_xboard.cc and proto_xboard.h. Now I
guess that someone just changed the number of bytes to be copied in line
#1087 to 512 to support long paths without bearing in mind that the
pointer EngineRunDir may have been allocated with less than these 512
bytes (it is defined in the proto_xboard.h as char[256]!!!). All other
references to the variable EngineRunDir have indeed a limitation to the
256 bytes. So one possibility would be, as my suggestion, was to change
the line #1087 to
snprintf(EngineRunDir,256,"%s/.eboard/craftylog",global.env.Home.c_str());
and leave all the rest as it ist or to change ALL references of
EngineRunDir to a value of 512 bytes where necessary to let EngineRunDir
be longer than 256 bytes.

What do you think?

So I'm looking forward to your answer or feel free to just fix the bug...

Greetings from Berlin to whereever you live

Lars

[Lex Ross (lross)]

Guess no one took the effort to release an official patch on Ubuntu 14.04 LTS as of today. Still have this bug. Lars, would you be so kind to attach a patch (basically a diff output) to this bug report. And thank you so much for adapted configure script!

[Christian Palazzo (g3k083)]

Hello,

just to notify that the bug was fixed on the eboard application:

https://github.com/fbergo/eboard/pull/12

new version of the application is 1.1.4.

Regards.

[Christian Palazzo (g3k083)]

The fix has been released on eboard application