[nas] segfault with 1.6a

[Jon Trulson]

On Tue, 30 Dec 2003, Lex Spoon wrote:

> From: Lex Spoon <lex at cc.gatech.edu>
> Date: Tue, 30 Dec 2003 16:14:41 -0400
> Subject: Re: [nas] segfault with 1.6a
> To: nas at radscan.com
> X-Spam-Status: No, hits=-4.7 required=5.0 tests=AWL,BAYES_00,HTML_MESSAGE,
> 	RCVD_IN_SORBS autolearn=no version=2.60
>
> Okay, I've posted to the Debian bug tracker, since it seems to be
> peculiar to Debian.
>
> I initially observed the problem with the precompiled Debian packages,
> but now I've recompiled them myself and seen the same thing.  Appended
> is a stack trace.  -Lex
>

	Try the attached patch to lib/audio/ConnSvr.c.  Some arguement
ordering confusion with GetAuthorization().  Let me know if it works -
definitely worth a 1.6b if so :)

>
> (gdb) bt
> #0  0x40202ea9 in free () from /lib/libc.so.6
> #1  0x0804ac9a in GetAuthorization (fd=7, family=256,
> saddrlen=134548560,
>     iserver=-7, saddr=0x1 <Address 0x1 out of bounds>,
> auth_namep=0xbffff980,
>     auth_namelenp=0xbffff984, auth_datap=0xbffff988,
> auth_datalenp=0xbffff98c)
>     at ConnSvr.c:1945
> #2  0x0804a4f0 in _AuConnectServer (server_name=0xbfffff8c ":1",
>     fullnamep=0xbffff978, svrnump=0xfffffff9, auth_namep=0xfffffff9,
>     auth_namelenp=0xfffffff9, auth_datap=0xfffffff9,
> auth_datalenp=0xfffffff9)
>     at ConnSvr.c:650
> #3  0x0804af33 in AuOpenServer (
>     server=0xfffffff9 <Address 0xfffffff9 out of bounds>,
> num_authproto=-7,
>     authproto=0x0, num_authdata=-7, authdata=0x0, ret_svrmsg=0xbffff9e8)
>     at OpenSvr.c:144
> #4  0x0804924d in main (argc=0, argv=0x0) at auinfo.c:101
>

-- 
Jon Trulson    mailto:jon at radscan.com
ID: 1A9A2B09, FP: C23F328A721264E7 B6188192EC733962
PGP keys at http://radscan.com/~jon/PGPKeys.txt
#include <std/disclaimer.h>
"I am Nomad." -Nomad
-------------- next part --------------
Index: ConnSvr.c
===================================================================
RCS file: /home/jon/src/repository/nas/lib/audio/ConnSvr.c,v
retrieving revision 1.10
diff -u -r1.10 ConnSvr.c
--- ConnSvr.c	2003/12/23 01:01:36	1.10
+++ ConnSvr.c	2003/12/31 07:24:07
@@ -136,7 +136,18 @@
 
 #endif /* CLIENTS_LOCALCONN */
 
-static void GetAuthorization();
+static void
+GetAuthorization(
+                 int fd,
+                 int family,
+                 int saddrlen,
+                 int iserver,
+                 char *saddr,
+                 char **auth_namep,			/* RETURN */
+                 int *auth_namelenp,			/* RETURN */
+                 char **auth_datap,			/* RETURN */
+                 int *auth_datalenp			/* RETURN */
+                 );
 
 static char *copystring (register _AuConst char *src, int len)
 {
@@ -185,7 +196,7 @@
 }
 
 static int
-_AuIsAudioOK(void)              /* JET - what is this doing here? */
+_AuIsAudioOK(void)              /* JET - what is this doing here?? */
 {
   if (access("/dev/audio", R_OK|W_OK) < 0)
     return(AuFalse);
@@ -542,7 +553,6 @@
     }
 #undef LOCALCONNECTION
 
-
     /*
      * Make the connection, also need to get the auth address info for
      * non-local connections.  Do retries in case server host has hit its
@@ -553,7 +563,12 @@
     if ((fd = (*connfunc) (phostname, &iserver, xname, AU_CONNECTION_RETRIES,
 			   &family, &saddrlen, &saddr)) < 0)
 #ifndef STARTSERVER
-		goto bad;
+      {
+# ifdef DEBUG
+        fprintf(stderr, "connfunc() failed, returned %d\n", fd );
+# endif
+        goto bad;
+      }
 #else /* STARTSERVER */
     {
       /* if local connection, try to start up a server */
@@ -571,6 +586,11 @@
 	    goto bad;
     }
 #endif /* STARTSERVER */
+
+#ifdef DEBUG
+    fprintf(stderr, "_AuConnectServer: fd = %d\n", fd);
+#endif
+
 #ifndef WIN32
     if (fd >= OPEN_MAX)
 	goto bad;
@@ -616,6 +636,9 @@
 	if (psvrnum) Aufree (psvrnum);
 	psvrnum = newsvrnum;
     }
+#ifdef DEBUG
+    fprintf(stderr, "_AuConnectServer: newsvrnum = '%s'\n", newsvrnum);
+#endif
 
     switch (family) {
       case AuNetworkInternet:
@@ -646,9 +669,14 @@
     *svrnump = iserver;
     if (phostname) Aufree (phostname);
     if (psvrnum && psvrnum != newsvrnum) Aufree (psvrnum);
+
+    GetAuthorization(fd, family, saddrlen, saviserver,
+		     saddr, auth_namep, auth_namelenp, auth_datap, 
+                     auth_datalenp);
+#ifdef DEBUG
+    fprintf(stderr, "_AuConnectServer: after GetAuthorization, fd = %d, saddr = %p\n", fd, saddr);
+#endif
 
-    GetAuthorization(fd, family, saddr, saddrlen, saviserver,
-		     auth_namep, auth_namelenp, auth_datap, auth_datalenp);
     return fd;
 
 
@@ -656,6 +684,9 @@
      * error return; make sure everything is cleaned up.
      */
   bad:
+#if defined(DEBUG)
+    fprintf(stderr, "_AuConnectServer: fd = %d, BAD return -1\n", fd);
+#endif
     if (fd >= 0) (void) close (fd);
     if (saddr) Aufree (saddr);
     if (phostname) Aufree (phostname);
@@ -826,10 +857,19 @@
      */
     do {
 	if ((fd = socket ((int) addr->sa_family, SOCK_STREAM, 0)) < 0) {
+#ifdef DEBUG
+          fprintf(stderr,
+                  "MakeUNIXSocketConnection: socket errno = %d\n", errno);
+#endif
+
 	    return -1;
 	}
 
 	if (connect (fd, addr, addrlen) < 0) {
+#ifdef DEBUG
+          fprintf(stderr,
+                  "MakeUNIXSocketConnection: connect errno = %d\n", errno);
+#endif
 	    int olderrno = errno;
 	    (void) close (fd);
 #ifdef hpux /* this is disgusting */
@@ -845,6 +885,11 @@
 #endif
 	    if (olderrno != ENOENT || retries <= 0) {
 		errno = olderrno;
+#ifdef DEBUG
+                fprintf(stderr, 
+                        "MakeUNIXSocketConnection: errno = %d\n", errno);
+#endif
+
 		return -1;
 	    }
 	    sleep (1);
@@ -856,6 +901,7 @@
     /*
      * Don't need to get auth info since we're local
      */
+
     return fd;
 }
 #endif /* UNIXCONN */
@@ -1205,6 +1251,10 @@
 	switch (ParseLocalName(to_try)) {
 	case TYPE_UNIX:
 #ifdef UNIXCONN
+
+# ifdef DEBUG
+    fprintf(stderr, "connect TYPE_UNIX\n");
+# endif
     	    fd = MakeUNIXSocketConnection(phostname, iserverp, retries,
 				          familyp, saddrlenp, saddrp);
 	    if (fd >= 0)