<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1501077043652_4943">seems like something weird is going on in helper.c... see the gdb output...<br></div><div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1501077043652_5075" style="display: block;"><div style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 13px;" id="yui_3_16_0_ym19_1_1501077043652_5074"><div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1501077043652_5073"><div class="y_msg_container" id="yui_3_16_0_ym19_1_1501077043652_5072"><div id="yiv8740665245"><div id="yui_3_16_0_ym19_1_1501077043652_5071"><div style="color:#000;background-color:#fff;font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px;" id="yui_3_16_0_ym19_1_1501077043652_5070"><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394">since transfer->file->filename can never be zero (as long as transfer->file plus 20 bytes or so is not zero),</div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394">it seems like someone is writing zeroes to the stack after the correct transfer->file->filename has been wrilten and b4 strlen() is called</div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394">(or do they use a register at -O2? nope: pushl 0x40(%esp) // call 3700 <strlen@plt>)...</div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394"><br clear="none"></div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394">maybe someone who knows more about transfer->file can see, what is wrong here...</div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394"><br clear="none"></div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394">-Arne</div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394"><br clear="none"></div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394">gdb output:</div><div dir="ltr" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3394">dnsmasq-dhcp: 3182551826 sent size: 4 option: 28 broadcast 192.168.1.255</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3395">dnsmasq-dhcp: 3182551826 sent size: 12 option:209 70:78:65:2f:67:72:75:62:2e:63:66:67</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3396">dnsmasq-dhcp: 3182551826 sent size: 4 option: 3 router 192.168.1.1</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3397">dnsmasq-tftp: error 8 User aborted the transfer received from 192.168.1.2</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3398">dnsmasq-tftp: failed sending /var/dnsmasq/tftpboot/pxe/x86_64-efi/core.efi to 192.168.1.2</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3399">dnsmasq-tftp: sent /var/dnsmasq/tftpboot/pxe/x86_64-efi/core.efi to 192.168.1.2</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3400"><br clear="none" id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3401"></div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3402">Program received signal SIGSEGV, Segmentation fault.</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3403">0xb7ef0bc6 in __strlen_sse2 () from /usr/lib/libc.so.6</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3404">(gdb) where</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3405">#0 0xb7ef0bc6 in __strlen_sse2 () from /usr/lib/libc.so.6</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3406">#1 0x8002b8b7 in queue_tftp (file_len=203776, filename=0x0, peer=0x8005bf68) at helper.c:819</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3407">#2 0x8002d3b3 in do_tftp_script_run () at tftp.c:811</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3408">#3 0x80006875 in main (argc=<optimized out>, argv=<optimized out>) at dnsmasq.c:955</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3409">(gdb) frame 1</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3410">#1 0x8002b8b7 in queue_tftp (file_len=203776, filename=0x0, peer=0x8005bf68) at helper.c:819</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3411">819<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3412" style="white-space:pre-wrap;"> </span> filename_len = strlen(filename) + 1;</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3413">(gdb) list</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3414">814<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3415" style="white-space:pre-wrap;"> </span></div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3416">815<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3417" style="white-space:pre-wrap;"> </span> /* no script */</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3418">816<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3419" style="white-space:pre-wrap;"> </span> if (daemon->helperfd == -1)</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3420">817<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3421" style="white-space:pre-wrap;"> </span> return;</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3422">818<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3423" style="white-space:pre-wrap;"> </span> </div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3424">819<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3425" style="white-space:pre-wrap;"> </span> filename_len = strlen(filename) + 1;</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3426">820<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3427" style="white-space:pre-wrap;"> </span> buff_alloc(sizeof(struct script_data) + filename_len);</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3428">821<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3429" style="white-space:pre-wrap;"> </span> memset(buf, 0, sizeof(struct script_data));</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3430">822<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3431" style="white-space:pre-wrap;"> </span></div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3432">823<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3433" style="white-space:pre-wrap;"> </span> buf->action = ACTION_TFTP;</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3434">(gdb) print filename</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3435">$1 = 0x0</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3436">(gdb) frame 2</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3437">#2 0x8002d3b3 in do_tftp_script_run () at tftp.c:811</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3438">811<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3439" style="white-space:pre-wrap;"> </span> queue_tftp(transfer->file->size, transfer->file->filename, &transfer->peer);</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3440">(gdb) list</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3441">806<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3442" style="white-space:pre-wrap;"> </span></div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3443">807<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3444" style="white-space:pre-wrap;"> </span> if ((transfer = daemon->tftp_done_trans))</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3445">808<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3446" style="white-space:pre-wrap;"> </span> {</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3447">809<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3448" style="white-space:pre-wrap;"> </span> daemon->tftp_done_trans = transfer->next;</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3449">810<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3450" style="white-space:pre-wrap;"> </span>#ifdef HAVE_SCRIPT</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3451">811<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3452" style="white-space:pre-wrap;"> </span> queue_tftp(transfer->file->size, transfer->file->filename, &transfer->peer);</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3453"><div class="yiv8740665245yqt4528091581" id="yiv8740665245yqtfd10173">812</div><span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3454" style="white-space:pre-wrap;"> </span>#endif</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3455">813<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3456" style="white-space:pre-wrap;"> </span> free_transfer(transfer);</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3457">814<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3458" style="white-space:pre-wrap;"> </span> return 1;</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3459">815<span id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3460" style="white-space:pre-wrap;"> </span> }</div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3461">(gdb) print *transfer->file</div><div></div><div id="yiv8740665245yui_3_16_0_ym19_1_1501073754773_3462">$2 = {refcount = 1, fd = 15, size = 203776, dev = 20, inode = 5570, filename = 0x8005bf68 "/var/dnsmasq/tftpboot/pxe/x86_64-efi/core.efi"}</div></div></div></div><br><br></div> </div> </div> </div></div></body></html>