Stack corruption in CPUStatus::updateToolTip()

View: New views

1 Messages — Rating Filter: Alert me

Stack corruption in CPUStatus::updateToolTip()

by Jörg Sommer :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Hi,

when building icewm 1.3.4pre2 with the following compiler and linker
flags, I get the libc6 stack corruption message on startup.

% echo $CFLAGS
-O2 -fPIC -fPIE -Wall -Wformat=2 -Wunused -Wundef -Wextra -Wswitch-enum -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wconversion -D_FORTIFY_SOURCE=2 -fstack-protector -Wbad-function-cast -Wnested-externs
% echo $CXXFLAGS
-O2 -fPIC -fPIE -Wall -Wformat=2 -Wunused -Wundef -Wextra -Wswitch-enum -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wconversion -D_FORTIFY_SOURCE=2 -fstack-protector
% echo $LDFLAGS
-Wl,-zrelro,-pie

*** buffer overflow detected ***: /home/joerg/programmieren/pkg/icewm-1.2.37+1.3.4pre2/src/icewm terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x6c)[0xfabcb5c]
/lib/libc.so.6[0xfabb608]
/lib/libc.so.6(__vsprintf_chk+0x0)[0xfaba7b0]
/lib/libc.so.6(__overflow+0x74)[0xfa386e4]
/lib/libc.so.6(__printf_fp+0x2174)[0xfa0e524]
/lib/libc.so.6(_IO_vfprintf+0x1334)[0xfa082c4]
/lib/libc.so.6(__vsprintf_chk+0xc0)[0xfaba870]
/lib/libc.so.6(__sprintf_chk+0x68)[0xfaba788]
/home/joerg/programmieren/pkg/icewm-1.2.37+1.3.4pre2/src/icewm[0x100620fc]
/home/joerg/programmieren/pkg/icewm-1.2.37+1.3.4pre2/src/icewm[0x10010ea4]
/home/joerg/programmieren/pkg/icewm-1.2.37+1.3.4pre2/src/icewm[0x1001441c]
/home/joerg/programmieren/pkg/icewm-1.2.37+1.3.4pre2/src/icewm[0x100388f4]
/home/joerg/programmieren/pkg/icewm-1.2.37+1.3.4pre2/src/icewm[0x10038d60]
/lib/libc.so.6[0xf9d7b04]
/lib/libc.so.6[0xf9d7cf4]
======= Memory map: ========
00100000-00103000 r-xp 00100000 00:00 0 [vdso]
0f49e000-0f4a6000 r-xp 00000000 03:04 343022 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
0f4a6000-0f4b5000 ---p 00008000 03:04 343022 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
0f4b5000-0f4b6000 rw-p 00007000 03:04 343022 /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
0f4c6000-0f4cc000 r-xp 00000000 03:04 185137 /usr/lib/libXfixes.so.3.1.0
0f4cc000-0f4db000 ---p 00006000 03:04 185137 /usr/lib/libXfixes.so.3.1.0
0f4db000-0f4dc000 rwxp 00005000 03:04 185137 /usr/lib/libXfixes.so.3.1.0
0f4ec000-0f4f7000 r-xp 00000000 03:04 184554 /usr/lib/libXcursor.so.1.0.2
0f4f7000-0f506000 ---p 0000b000 03:04 184554 /usr/lib/libXcursor.so.1.0.2
0f506000-0f507000 rw-p 0000a000 03:04 184554 /usr/lib/libXcursor.so.1.0.2
0f517000-0f51e000 r-xp 00000000 03:04 184879 /usr/lib/libXdmcp.so.6.0.0
0f51e000-0f52d000 ---p 00007000 03:04 184879 /usr/lib/libXdmcp.so.6.0.0
0f52d000-0f52e000 rw-p 00006000 03:04 184879 /usr/lib/libXdmcp.so.6.0.0
0f53e000-0f55e000 r-xp 00000000 03:04 97746 /lib/libselinux.so.1
0f55e000-0f55f000 r--p 00020000 03:04 97746 /lib/libselinux.so.1
0f55f000-0f560000 rw-p 00021000 03:04 97746 /lib/libselinux.so.1
0f570000-0f59c000 r-xp 00000000 03:04 184072 /usr/lib/libexpat.so.1.5.2
0f59c000-0f5ac000 ---p 0002c000 03:04 184072 /usr/lib/libexpat.so.1.5.2
0f5ac000-0f5ae000 rw-p 0002c000 03:04 184072 /usr/lib/libexpat.so.1.5.2
0f5be000-0f5d3000 r-xp 00000000 03:04 180182 /usr/lib/libz.so.1.2.3.3
0f5d3000-0f5e2000 ---p 00015000 03:04 180182 /usr/lib/libz.so.1.2.3.3
0f5e2000-0f5e3000 rw-p 00014000 03:04 180182 /usr/lib/libz.so.1.2.3.3
0f5f3000-0f675000 r-xp 00000000 03:04 181647 /usr/lib/libfreetype.so.6.3.20
0f675000-0f684000 ---p 00082000 03:04 181647 /usr/lib/libfreetype.so.6.3.20
0f684000-0f688000 rw-p 00081000 03:04 181647 /usr/lib/libfreetype.so.6.3.20
0f698000-0f69c000 r-xp 00000000 03:04 180077 /usr/lib/libXau.so.6.0.0
0f69c000-0f6ab000 ---p 00004000 03:04 180077 /usr/lib/libXau.so.6.0.0
0f6ab000-0f6ac000 rw-p 00003000 03:04 180077 /usr/lib/libXau.so.6.0.0
0f6bc000-0f6c7000 r-xp 00000000 03:04 184317 /usr/lib/libXrender.so.1.3.0
0f6c7000-0f6d7000 ---p 0000b000 03:04 184317 /usr/lib/libXrender.so.1.3.0
0f6d7000-0f6d8000 rw-p 0000b000 03:04 184317 /usr/lib/libXrender.so.1.3.0
0f6e8000-0f6eb000 r-xp 00000000 03:04 97891 /lib/libdl-2.9.so
0f6eb000-0f6fa000 ---p 00003000 03:04 97891 /lib/libdl-2.9.so
0f6fa000-0f6fb000 r--p 00002000 03:04 97891 /lib/libdl-2.9.so
0f6fb000-0f6fc000 rw-p 00003000 03:04 97891 /lib/libdl-2.9.so
0f70c000-0f728000 r-xp 00000000 03:04 180414 /usr/lib/libxcb.so.1.1.0
0f728000-0f737000 ---p 0001c000 03:04 180414 /usr/lib/libxcb.so.1.1.0
0f737000-0f738000 rw-p 0001b000 03:04 180414 /usr/lib/libxcb.so.1.1.0
0f748000-0f74e000 r-xp 00000000 03:04 97803 /lib/libuuid.so.1.2
0f74e000-0f75d000 ---p 00006000 03:04 97803 /lib/libuuid.so.1.2
0f75d000-0f75e000 rw-p 00005000 03:04 97803 /lib/libuuid.so.1.2
0f76e000-0f79b000 r-xp 00000000 03:04 184070 /usr/lib/libpcre.so.3.12.1
0f79b000-0f7aa000 ---p 0002d000 03:04 184070 /usr/lib/libpcre.so.3.12.1
0f7aa000-0f7ab000 rw-p 0002c000 03:04 184070 /usr/lib/libpcre.so.3.12.1
0f7bb000-0f893000 r-xp 00000000 03:04 180043 /usr/lib/libglib-2.0.so.0.2000.4
0f893000-0f8a3000 ---p 000d8000 03:04 180043 /usr/lib/libglib-2.0.so.0.2000.4
0f8a3000-0f8a6000 rw-p 000d8000 03:04 180043 /usr/lib/libglib-2.0.so.0.2000.4
0f8b6000-0f8bb000 r-xp 00000000 03:04 180057 /usr/lib/libgmodule-2.0.so.0.2000.4
0f8bb000-0f8ca000 ---p 00005000 03:04 180057 /usr/lib/libgmodule-2.0.so.0.2000.4
0f8ca000-0f8cb000 rw-p 00004000 03:04 180057 /usr/lib/libgmodule-2.0.so.0.2000.4
0f8db000-0f96b000 r-xp 00000000 03:04 180035 /usr/lib/libgio-2.0.so.0.2000.4
0f96b000-0f96f000 rw-p
Program received signal SIGABRT, Aborted.

(gdb) bt
#0 0x0f9f043c in *__GI_raise (sig=6)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x0f9f5cc4 in *__GI_abort () at abort.c:88
#2 0x0fa2c584 in __libc_message (do_abort=2,
fmt=0xfb0cdd8 "*** %s ***: %s terminated\n")
at ../sysdeps/unix/sysv/linux/libc_fatal.c:173
#3 0x0fabcb5c in *__GI___fortify_fail (
msg=0xfb0cd7c "buffer overflow detected") at fortify_fail.c:32
#4 0x0fabb608 in *__GI___chk_fail () at chk_fail.c:29
#5 0x0faba7b0 in _IO_str_chk_overflow (fp=<value optimized out>,
c=<value optimized out>) at vsprintf_chk.c:35
#6 0x0fa386e4 in *__GI___overflow (f=0xbff9bd68, ch=54) at genops.c:248
#7 0x0fa0e524 in ___printf_fp (fp=0xbff9bd68, info=0xbff9b830,
args=<value optimized out>) at printf_fp.c:1241
#8 0x0fa082c4 in _IO_vfprintf_internal (s=0xbff9bd68,
format=0x483bbe76 "\nAusl.-Speicher: %.2f/%.2fM", ap=0xbff9be48)
at vfprintf.c:1601
#9 0x0faba870 in ___vsprintf_chk (s=<value optimized out>, flags=1, slen=31,
format=0x483bbe76 "\nAusl.-Speicher: %.2f/%.2fM", args=0xbff9be48)
at vsprintf_chk.c:87
#10 0x0faba788 in ___sprintf_chk (s=<value optimized out>,
flags=<value optimized out>, slen=<value optimized out>,
format=<value optimized out>) at sprintf_chk.c:33
#11 0x100620fc in CPUStatus::updateToolTip() ()
#12 0x10010ea4 in TaskBar::initApplets() ()
#13 0x1001441c in TaskBar::TaskBar(YWindow*) ()
#14 0x100388f4 in YWMApp::YWMApp(int*, char***, char const*) ()
#15 0x10038d60 in main ()

(gdb) info fram
Stack level 11, frame at 0xbff9c010:
pc = 0x100620fc in CPUStatus::updateToolTip(); saved pc 0x10010ea4
called by frame at 0xbff9c1d0, caller of frame at 0xbff9beb0
source language asm.
Arglist at 0xbff9beb0, args:
Locals at 0xbff9beb0, Previous frame's sp is 0xbff9c010
Saved registers:
r25 at 0xbff9bfd4, r26 at 0xbff9bfd8, r27 at 0xbff9bfdc, r28 at 0xbff9bfe0,
r29 at 0xbff9bfe4, r30 at 0xbff9bfe8, r31 at 0xbff9bfec, f28 at 0xbff9bff0,
f29 at 0xbff9bff8, f30 at 0xbff9c000, f31 at 0xbff9c008, pc at 0xbff9c014,
lr at 0xbff9c014

Bye, Jörg.
--
“Science is the game we play with God to find out what his rules are.”

------------------------------------------------------------------------------
Enter the BlackBerry Developer Challenge
This is your chance to win up to $100,000 in prizes! For a limited time,
vendors submitting new applications to BlackBerry App World(TM) will have
the opportunity to enter the BlackBerry Developer Challenge. See full prize
details at: http://p.sf.net/sfu/Challenge
_______________________________________________
IceWM-user mailing list
IceWM-user@...
https://lists.sourceforge.net/lists/listinfo/icewm-user