moria fails to start with "Abort" error

[Mike Vitale]

I installed the "moria" package on Oneiric Ocelot and got the 5.6-2 version. Added myself to the "games" group. Running "moria" from the CLI produces "Abort" and no other output. strace included below.

Hardware is a Lenovo ThinkPad laptop, and my home directory is encrypted.

I expect to be able to roll up a new character. :)

[mike@mike ~]$ lsb_release -rd
Description: Ubuntu 11.10
Release: 11.10
[mike@mike ~]$ apt-cache policy moria
moria:
  Installed: 5.6-2
  Candidate: 5.6-2
  Version table:
 *** 5.6-2 0
        500 http://us.archive.ubuntu.com/ubuntu/ oneiric/universe amd64 Packages
        100 /var/lib/dpkg/status
[mike@mike ~]$ moria
Abort
[mike@mike ~]$ strace moria
execve("/usr/games/moria", ["moria"], [/* 63 vars */]) = 0
brk(0) = 0x19f7000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd960913000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=120360, ...}) = 0
mmap(NULL, 120360, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fd9608f5000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/libncurses.so.5", O_RDONLY) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260Y\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=133808, ...}) = 0
mmap(NULL, 2229440, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fd9604d4000
mprotect(0x7fd9604f3000, 2097152, PROT_NONE) = 0
mmap(0x7fd9606f3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1f000) = 0x7fd9606f3000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \24\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1677624, ...}) = 0
mmap(NULL, 3793768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fd960135000
mprotect(0x7fd9602ca000, 2093056, PROT_NONE) = 0
mmap(0x7fd9604c9000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x194000) = 0x7fd9604c9000
mmap(0x7fd9604ce000, 21352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fd9604ce000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\r\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14768, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd9608f4000
mmap(NULL, 2109704, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fd95ff31000
mprotect(0x7fd95ff33000, 2097152, PROT_NONE) = 0
mmap(0x7fd960133000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fd960133000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/libtinfo.so.5", O_RDONLY) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\301\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=159200, ...}) = 0
mmap(NULL, 2255936, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fd95fd0a000
mprotect(0x7fd95fd2c000, 2097152, PROT_NONE) = 0
mmap(0x7fd95ff2c000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x22000) = 0x7fd95ff2c000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd9608f3000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd9608f1000
arch_prctl(ARCH_SET_FS, 0x7fd9608f1720) = 0
mprotect(0x7fd95ff2c000, 16384, PROT_READ) = 0
mprotect(0x7fd960133000, 4096, PROT_READ) = 0
mprotect(0x7fd9604c9000, 16384, PROT_READ) = 0
mprotect(0x7fd9606f3000, 4096, PROT_READ) = 0
mprotect(0x64a000, 4096, PROT_READ) = 0
mprotect(0x7fd960915000, 4096, PROT_READ) = 0
munmap(0x7fd9608f5000, 120360) = 0
brk(0) = 0x19f7000
brk(0x1a18000) = 0x1a18000
open("/var/games/moria/scores", O_RDWR) = 3
getuid() = 1000
setuid(1000) = 0
getgid() = 1000
setgid(1000) = 0
ioctl(0, SNDCTL_TMR_TEMPO or TCGETA, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
stat("/home/mvitale/.terminfo", 0x7fff16e6f4a0) = -1 ENOENT (No such file or directory)
stat("/etc/terminfo", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
access("/etc/terminfo/x/xterm", R_OK) = -1 ENOENT (No such file or directory)
stat("/lib/terminfo", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
access("/lib/terminfo/x/xterm", R_OK) = 0
open("/lib/terminfo/x/xterm", O_RDONLY) = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=3213, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fd960912000
read(4, "\32\1\34\0&\0\17\0\235\1Z\5xterm|X11 terminal e"..., 4096) = 3213
read(4, "", 4096) = 0
close(4) = 0
munmap(0x7fd960912000, 4096) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, TIOCGWINSZ, {ws_row=39, ws_col=132, ws_xpixel=0, ws_ypixel=0}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, TIOCGWINSZ, {ws_row=39, ws_col=132, ws_xpixel=0, ws_ypixel=0}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
brk(0x1a39000) = 0x1a39000
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_STOP or TCSETSW, {B38400 opost isig -icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig -icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig -icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_STOP or TCSETSW, {B38400 opost isig -icanon -echo ...}) = 0
                                                                               ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig -icanon -echo ...}) = 0
                             rt_sigaction(SIGTSTP, NULL, {SIG_DFL, [], 0}, 8) = 0
                                                                                 rt_sigaction(SIGTSTP, {0x7fd9604e7b50, [], SA_RESTORER|SA_RESTART, 0x7fd96016b420}, NULL, 8) = 0
                                             rt_sigaction(SIGINT, NULL, {SIG_DFL, [], 0}, 8) = 0
                                                                                                rt_sigaction(SIGINT, {0x7fd9604e7a80, [], SA_RESTORER|SA_RESTART, 0x7fd96016b420}, NULL, 8) = 0
                                                           rt_sigaction(SIGTERM, NULL, {SIG_DFL, [], 0}, 8) = 0
                                                                                                               rt_sigaction(SIGTERM, {0x7fd9604e7a80, [], SA_RESTORER|SA_RESTART, 0x7fd96016b420}, NULL, 8) = 0
                                                                           rt_sigaction(SIGWINCH, NULL, {SIG_DFL, [], 0}, 8) = 0
                                                                                                                                rt_sigaction(SIGWINCH, {0x7fd9604e7a70, [], SA_RESTORER, 0x7fd96016b420}, NULL, 8) = 0
                                                                                  ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig -icanon -echo ...}) = 0
                                rt_sigaction(SIGTSTP, {0x40c520, [], SA_RESTORER|SA_INTERRUPT|SA_NODEFER|SA_RESETHAND, 0x7fd96016b420}, {0x7fd9604e7b50, [], SA_RESTORER|SA_RESTART, 0x7fd96016b420}, 8) = 0
                                                                        rt_sigaction(SIGTSTP, {SIG_IGN, [], SA_RESTORER|SA_RESTART, 0x7fd96016b420}, {0x40c520, [], SA_RESTORER|SA_INTERRUPT|SA_NODEFER|SA_RESETHAND, 0x7fd96016b420}, 8) = 0
                                                                                                         write(1, "\33[?1049h\33[1;3) = 29B\33[m\33[4l\33[?7h\33["..., 37
      ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig -icanon -echo ...}) = 0
                                                                                        ioctl(1, SNDCTL_TMR_STOP or TCSETSW, {B38400 opost isig icanon echo ...}) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(0, SNDCTL_TMR_SOURCE or TCSETA, {B38400 opost isig icanon echo ...}) = 0
rt_sigaction(SIGABRT, {SIG_DFL, [], SA_RESTORER|SA_INTERRUPT|SA_NODEFER|SA_RESETHAND, 0x7fd96016b420}, {SIG_DFL, [], SA_RESTORER|SA_INTERRUPT|SA_NODEFER|SA_RESETHAND, 0x7fd96016b420}, 8) = 0
kill(2791, SIGABRT) = 0
--- SIGABRT (Aborted) @ 0 (0) ---
+++ killed by SIGABRT +++
Abort

[Hans Joachim Desserud (hjd)]

Thanks for reporting this issue!

I also get the error message "aborted" when attempting to run moria. When running it in gdb, it additionally prints the message
Can't open score file "/var/games/moria/scores"
Just to check, I changed permisson of this file, but it still aborts. gdb seem to offer more information at this point, though.

Fwiw, this also affects Ubuntu Precise.

[Ben Hearsum (bhearsum)]

I'm hitting this in 12.04.

[Ben Shadwick (benshadwick)]

I'm also seeing this in Xubuntu 12.04 x64. I've tried running via a PuTTY (ssh) connection and an X2go (X11) connection.

I believe the scores file issue is meant to be fixed by adding the user to the 'games' group. That doesn't fix the "aborted" error, though.

[Ben Hearsum (bhearsum)]

I'm hitting this in Ubuntu 12.04, too.

[Hans Joachim Desserud (hjd)]

It also affects Ubuntu Quantal, which is not that suprising considering they all have the same package version, 5.6-2. Out of curiosity, I tried moria on an up-to-date Debian Sid system which also has the same package version, but it ran fine there. This suggests it might be an Ubuntu-specific problem.

[Dave Gilbert (ubuntu-treblig)]

Triaged -> Trivially reproducable
High->Prevents app from functioning correctly at all
(for hjd via #ubuntu+1)

[Uqbar (uqbar)]

Also running is at root will yield the same results ...
Is there anyone caring about this?

[Uqbar (uqbar)]

I've tried to touch a brand new file in my home and to run moria with that score file as an option.
But no luck: it still aborts ...

[Rob Jarvis (rjarvis2010)]

When you run it from a VT (Ctrl-Alt-F1 works) you get some output. Redirecting stdout shows that it's trying to create a file and it fails, but doesn't indicate which file. Redirecting both stderr and stdout makes the kernel output easier to read (but hard to capture): *** buffer overflow detected ***: moria terminated.

There's some diagnostics afterwards. I'll try and capture them sensibly and attach.

[Uqbar (uqbar)]

Just for the sake of completeness, I attach here what I get from the above hint.
I've "simply" run:
mora &> moriaabort.txt

The file itself contains some VT-100-like screen codes along with some interesting string:
"OH NO!!!!!! A gruesome software bug LEAPS out at you. There is NO defense!"
It comes from a function "static void signal_handler(sig, code, scp)" which should be a signal handler.
I also attach later the "kernel" messages I captured.

My idea is that there's some problem with unchecked file access permissions, not in the home directory.

[Uqbar (uqbar)]

Here comes the rest of the output.

[Uqbar (uqbar)]

In order to find out which files get opened, I've run the following command:

# strings /usr/games/moria | grep ^/
/lib64/ld-linux-x86-64.so.2
/tSH
/var/games/moria/scores
/etc/moria-hours
/usr/lib/games/moria/news
/bin/sh
/usr/lib/games/moria/welcome.hlp
/usr/share/common-licences/GPL-3
/usr/lib/games/moria/roglcmds.hlp
/usr/lib/games/moria/origcmds.hlp
/usr/lib/games/moria/version.hlp
/usr/lib/games/moria/rwizcmds.hlp
/usr/lib/games/moria/owizcmds.hlp
/tmp/moria.%ld
/%s\,;_ _;,,,;_
/ RIP \ \ : : / \
/ - A pole weapon.

Apart of a few lines clearly not related to file paths, I've checked that all of them were accessible (readable) from my user.
The only thing I've found is a typo (c-s mismatch):

/usr/share/common-licences/GPL-3

instead of

/usr/share/common-licenses/GPL-3
(LICENSES not LICENCES).
I've created a symbolic link in order to bypass the bug, but it's been useless. The error is still there.

[Dave Gilbert (ubuntu-treblig)]

OK, it's a one char overrun in the hours reading code; because someone forgot the remove the \n
This starts up, but I don't know the game so haven't checked the 'hours' work as intended.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Fix for a 1 char overrun in hours reading code" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-reviewers team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

[Ben Hearsum (bhearsum)]

Dave, thank you for this patch - it's working great for me.

Does anyone know if there's anything I can do to help get this patch landed and the package fixed?

[Dave Gilbert (ubuntu-treblig)]

Ben Hearsum: I don't think there's much to be done; I could try asking for an Ubuntu patch for it; the debian maintainer said he'd have a look at it (see debian bug) a few months back, but doesn't seem to have got anywhere, but the problem is Debian is stuck in release freeze.

[Sherick De Baan (rickdebaan)]

Running Sabayon on a Dell latitude D360 Laptop with Mate desktop.

Running moria from mate terminal gets this result

*** buffer overflow detected ***: moria - terminated
                                                    moria: buffer overflow attack in function <unknown> - terminated
                                    Report to http://bugs.gentoo.org/
                                                                     Killed

Hope this is useful.

[Hans Joachim Desserud (hjd)]

As the bug watcher status message above mentioned, this issue was fixed in Debian. The new package version, 5.6.debian.1-1, has been synced to the current development version of Ubuntu (Trusty Tahr). There, moria starts as expected.

 This is a significant bug in Ubuntu. If you need a fix for the bug in previous versions of Ubuntu, please perform as much as possible of the SRU Procedure [1] to bring the need to a developer's attention.

 [1]: https://wiki.ubuntu.com/StableReleaseUpdates#Procedure

[Dave Gilbert (ubuntu-treblig)]

Tested in Tahr, seems to start up.