[Bug 691345] Re: buffer overflow

[Dustin Kirkland]

Crashes attached.

** Attachment added: "691345.txt"
   https://bugs.launchpad.net/ubuntu/+source/netkit-tftp/+bug/691345/+attachment/1768201/+files/691345.txt

** Summary changed:

- buffer overflow
+ buffer overflow in tftp

** Description changed:

  Binary package hint: tftp-hpa
  
  I'm getting a buffer overflow from tftp in both tftp-hpa and tfp
  packages in Natty.  I'll attach each below.
  
  Looks like something exposed by Natty's updated toolchain, as I'm not seeing this error in Maverick or Lucid.
- --- 
+ ---
  Architecture: amd64
  DistroRelease: Ubuntu 11.04
  EcryptfsInUse: Yes
  InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Alpha amd64 (20101202)
  Package: tftp-hpa 5.0-18ubuntu1
  PackageArchitecture: amd64
  ProcEnviron:
-  LANGUAGE=en_US:en
-  PATH=(custom, user)
-  LANG=en_US.UTF-8
-  LC_MESSAGES=en_US.utf8
-  SHELL=/bin/bash
+  LANGUAGE=en_US:en
+  PATH=(custom, user)
+  LANG=en_US.UTF-8
+  LC_MESSAGES=en_US.utf8
+  SHELL=/bin/bash
  ProcVersionSignature: Ubuntu 2.6.37-9.23-generic 2.6.37-rc5
  Tags: natty
  Uname: Linux 2.6.37-9-generic x86_64
  UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare
+ 
+ 
+ kirkland at x201:~$ tftp dalmation
+ tftp> get cpuinfo
+ *** buffer overflow detected ***: tftp terminated
+ ======= Backtrace: =========
+ /lib/libc.so.6(__fortify_fail+0x37)[0x7f5079977557]
+ /lib/libc.so.6(+0xfe410)[0x7f5079976410]
+ tftp[0x4015f1]
+ tftp[0x402065]
+ tftp[0x4036c9]
+ /lib/libc.so.6(__libc_start_main+0xfe)[0x7f5079896d8e]
+ tftp[0x4014d9]
+ ======= Memory map: ========
+ 00400000-00406000 r-xp 00000000 08:01 6297104                            /usr/bin/tftp
+ 00605000-00606000 r--p 00005000 08:01 6297104                            /usr/bin/tftp
+ 00606000-00607000 rw-p 00006000 08:01 6297104                            /usr/bin/tftp
+ 00607000-00627000 rw-p 00000000 00:00 0
+ 0174d000-0176e000 rw-p 00000000 00:00 0                                  [heap]
+ 7f5078e33000-7f5078e48000 r-xp 00000000 08:01 3932219                    /lib/libgcc_s.so.1
+ 7f5078e48000-7f5079047000 ---p 00015000 08:01 3932219                    /lib/libgcc_s.so.1
+ 7f5079047000-7f5079048000 r--p 00014000 08:01 3932219                    /lib/libgcc_s.so.1
+ 7f5079048000-7f5079049000 rw-p 00015000 08:01 3932219                    /lib/libgcc_s.so.1
+ 7f5079049000-7f507905f000 r-xp 00000000 08:01 3932328                    /lib/libresolv-2.12.1.so
+ 7f507905f000-7f507925e000 ---p 00016000 08:01 3932328                    /lib/libresolv-2.12.1.so
+ 7f507925e000-7f507925f000 r--p 00015000 08:01 3932328                    /lib/libresolv-2.12.1.so
+ 7f507925f000-7f5079260000 rw-p 00016000 08:01 3932328                    /lib/libresolv-2.12.1.so
+ 7f5079260000-7f5079262000 rw-p 00000000 00:00 0
+ 7f5079262000-7f5079267000 r-xp 00000000 08:01 3932280                    /lib/libnss_dns-2.12.1.so
+ 7f5079267000-7f5079466000 ---p 00005000 08:01 3932280                    /lib/libnss_dns-2.12.1.so
+ 7f5079466000-7f5079467000 r--p 00004000 08:01 3932280                    /lib/libnss_dns-2.12.1.so
+ 7f5079467000-7f5079468000 rw-p 00005000 08:01 3932280                    /lib/libnss_dns-2.12.1.so
+ 7f5079468000-7f507946a000 r-xp 00000000 08:01 3932288                    /lib/libnss_mdns4_minimal.so.2
+ 7f507946a000-7f5079669000 ---p 00002000 08:01 3932288                    /lib/libnss_mdns4_minimal.so.2
+ 7f5079669000-7f507966a000 r--p 00001000 08:01 3932288                    /lib/libnss_mdns4_minimal.so.2
+ 7f507966a000-7f507966b000 rw-p 00002000 08:01 3932288                    /lib/libnss_mdns4_minimal.so.2
+ 7f507966b000-7f5079677000 r-xp 00000000 08:01 3932282                    /lib/libnss_files-2.12.1.so
+ 7f5079677000-7f5079876000 ---p 0000c000 08:01 3932282                    /lib/libnss_files-2.12.1.so
+ 7f5079876000-7f5079877000 r--p 0000b000 08:01 3932282                    /lib/libnss_files-2.12.1.so
+ 7f5079877000-7f5079878000 rw-p 0000c000 08:01 3932282                    /lib/libnss_files-2.12.1.so
+ 7f5079878000-7f50799f2000 r-xp 00000000 08:01 3932207                    /lib/libc-2.12.1.so
+ 7f50799f2000-7f5079bf1000 ---p 0017a000 08:01 3932207                    /lib/libc-2.12.1.so
+ 7f5079bf1000-7f5079bf5000 r--p 00179000 08:01 3932207                    /lib/libc-2.12.1.so
+ 7f5079bf5000-7f5079bf6000 rw-p 0017d000 08:01 3932207                    /lib/libc-2.12.1.so
+ 7f5079bf6000-7f5079bfb000 rw-p 00000000 00:00 0
+ 7f5079bfb000-7f5079c1b000 r-xp 00000000 08:01 3932183                    /lib/ld-2.12.1.so
+ 7f5079df8000-7f5079dfb000 rw-p 00000000 00:00 0
+ 7f5079e16000-7f5079e1b000 rw-p 00000000 00:00 0
+ 7f5079e1b000-7f5079e1c000 r--p 00020000 08:01 3932183                    /lib/ld-2.12.1.so
+ 7f5079e1c000-7f5079e1d000 rw-p 00021000 08:01 3932183                    /lib/ld-2.12.1.so
+ 7f5079e1d000-7f5079e1e000 rw-p 00000000 00:00 0
+ 7fffbc9fb000-7fffbca1d000 rw-p 00000000 00:00 0                          [stack]
+ 7fffbcbcf000-7fffbcbd0000 r-xp 00000000 00:00 0                          [vdso]
+ ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
+ Aborted

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to tftp-hpa in ubuntu.
https://bugs.launchpad.net/bugs/691345

Title:
  buffer overflow in tftp