[Pidgin] #14430: IBB receiver reads struct after free (at completion of transfer)

Pidgin trac at pidgin.im
Sun Jul 17 01:49:14 EDT 2011


#14430: IBB receiver reads struct after free (at completion of transfer)
------------------------+---------------------------------------------------
 Reporter:  darkrain42  |        Owner:  malu
     Type:  defect      |       Status:  new 
Milestone:              |    Component:  XMPP
  Version:  2.9.0       |   Resolution:      
 Keywords:              |  
------------------------+---------------------------------------------------

Old description:

> While trying to reproduce another file transfer situation, I ran across
> this in valgrind.
>

>
> {{{
> (22:40:44) jabber: Recv (ssl)(1397): <iq id='purple267a717a' type='set'
> to='me' from='my friend'><data xmlns='http://jabber.org/protocol/ibb'
> seq='1'
> sid='purple267a7176'>FTFfsOWgeAtyoZlOJ5pKHnKMsmU0lVYg8Kfq31U6qgKFhJQKwcEp6NoiadtBwBCtT2KcZSAUSaQTyKnJ8pRfLzCegkcsbdWFwZOULS1LSoaT47TJlOCJ7WyWqq9nlrcshoKCUIJzHM+Zsazd/e1pfWrgRmJ+4ZkCtoOYu7mW5nWTTo58GiBcihAfaNL2J2Bu0fMRasNjarY2EQMhw4gTRuq0tQSJhZTWijOnurlCdRrJhxwl+CIxq3ZqQsoWKSUneSQ4SSnbAz4BJTc9/ojkVORYG38DBMWSzG0oKbJEKYiE7Nd4wat12gFbc6wjwreheQFUypSEF1QcH8S0cQQw6PiDgHIlEK7hsK62iyUNQrqJlOCUESMe5AosdvxWcpSqMVtotrYFQuLkNhyU85wYVnRlhE27OsSptGczgXGVezTTziplMpqiZBJ57t1zkqUSG2qZlAxTsG41MwV2SU4xtA0lDLaRBolTddnxYpJSoEEWZJBsQd2ArRWC4YYVuSVhK0k6Gtmhqr8dJWNWh2EH1ZCrESA56sSLV8ElwKapGWyBtWdiZdsm8xtQMmy0BuOI4/hbVkxYFbakZawkDJj9Hc3Ls5fVCYQu7NkF5SwdjUG1JKbbAwWIUkt0AMTQL+zxTFmXr8xB7Mw5+odSbfCkr6Z3npijOSmLToiA9XKJDM4+CRdmThskL41Q1y59gvaMWJ2JGRKeyQszieDOdMdHlCSIfJ0qDNl3Z2a1VPXcg88vWitB+Jl2ULGNPhlvZFlTzQ1bKsDqRe1Qqc7LIZyY+Rkhgz1CRoaDasQZnoIUJfTl4Rsr8ZflF0uZ12vGNFd9QcXvJnCo0MQxPr4XhRi11mKR2GTqFtm3QrB6zj6a23VWUeuMIYRPbMW0KXCNRVGai7YmxyVokJT+FTF/6RcDfxe0/pEU5eznLIUKDrx1aIZmxIOkLOIxu0J+rQzCJdIjsu5AdlQb5BscLkYxQIXaJbkEiEE5vefVkETPXBjkyTT9CdvS9RMgZY1h9w3MxImz/U7A5Lx7JmPROFaMVNEoLuXxxyKeYicQqpgpMDSFd/yg2+CiX2Mh08rGJmMh1qGdPU0utHxUIkLJaMbvBwcYZPoZQG5DJKxyQdInw6m3Oh1vFK2bRGAv0NqheblBhDypUYfEpr1TMSd2KJX024kzh4AqGauEhayQlI+n0ONLTeP/4u5IpwoSD7LyxQA=</data></iq>
> (22:40:44) jabber: got 908 bytes of data on IBB stream
> (22:40:44) jabber: calling IBB callback for received data
> (22:40:44) jabber: about to write 908 bytes from IBB stream
> (22:40:44) xfer: Prpl (and UI) ready on ft 0x219548f0, so proceeding
> (22:40:44) jabber: jabber_si_xfer_free: destroying IBB session
> (22:40:44) jabber: IBB: destroying session 0x29e031a0 purple267a7176
> (22:40:44) jabber: Sending (ssl) (me): <iq type='set' id='purpleafaa4128'
> to='my friend'><close xmlns='http://jabber.org/protocol/ibb'
> sid='purple267a7176'/></iq>
> (22:40:44) jabber: jabber_si_xfer_free(): freeing jsx 0x21934360
> ==25203== Invalid read of size 2
> ==25203==    at 0x1DB12695: jabber_ibb_parse (ibb.c:455)
> ==25203==    by 0x1DB1C00A: jabber_process_packet (jabber.c:345)
> ==25203==    by 0x1DB28FA6: jabber_parser_element_end_libxml
> (parser.c:169)
> ==25203==    by 0x6345A92: ??? (in /usr/lib/libxml2.so.2.7.8)
> ==25203==    by 0x634C92F: ??? (in /usr/lib/libxml2.so.2.7.8)
> ==25203==    by 0x634E0A7: xmlParseChunk (in /usr/lib/libxml2.so.2.7.8)
> ==25203==    by 0x1DB2901C: jabber_parser_process (parser.c:279)
> ==25203==    by 0x1DB17E91: jabber_recv_cb_ssl (jabber.c:659)
> ==25203==    by 0x46E87D: pidgin_io_invoke (gtkeventloop.c:73)
> ==25203==    by 0x90044A2: g_main_context_dispatch (gmain.c:2440)
> ==25203==    by 0x9004C7F: g_main_context_iterate.clone.6 (gmain.c:3091)
> ==25203==    by 0x90052F1: g_main_loop_run (gmain.c:3299)
> ==25203==    by 0x679AA76: gtk_main (gtkmain.c:1256)
> ==25203==    by 0x435858: main (gtkmain.c:934)
> ==25203==  Address 0x29e031c2 is 34 bytes inside a block of size 112
> free'd
> ==25203==    at 0x4C268FE: free (in /usr/lib/valgrind/vgpreload_memcheck-
> amd64-linux.so)
> ==25203==    by 0x1DB2D7C6: jabber_si_xfer_free (si.c:1357)
> ==25203==    by 0x9319E11: purple_xfer_end (ft.c:1453)
> ==25203==    by 0x931A81A: do_transfer (ft.c:1262)
> ==25203==    by 0x1DB1268C: jabber_ibb_parse (ibb.c:442)
> ==25203==    by 0x1DB1C00A: jabber_process_packet (jabber.c:345)
> ==25203==    by 0x1DB28FA6: jabber_parser_element_end_libxml
> (parser.c:169)
> ==25203==    by 0x6345A92: ??? (in /usr/lib/libxml2.so.2.7.8)
> ==25203==    by 0x634C92F: ??? (in /usr/lib/libxml2.so.2.7.8)
> ==25203==    by 0x634E0A7: xmlParseChunk (in /usr/lib/libxml2.so.2.7.8)
> ==25203==    by 0x1DB2901C: jabber_parser_process (parser.c:279)
> ==25203==    by 0x1DB17E91: jabber_recv_cb_ssl (jabber.c:659)
> ==25203==    by 0x46E87D: pidgin_io_invoke (gtkeventloop.c:73)
> ==25203==    by 0x90044A2: g_main_context_dispatch (gmain.c:2440)
> ==25203==    by 0x9004C7F: g_main_context_iterate.clone.6 (gmain.c:3091)
> ==25203==    by 0x90052F1: g_main_loop_run (gmain.c:3299)
> ==25203==    by 0x679AA76: gtk_main (gtkmain.c:1256)
> ==25203==    by 0x435858: main (gtkmain.c:934)
> ==25203==
> }}}

New description:

 While trying to reproduce another file transfer situation, I ran across
 this in valgrind.



 {{{
 (22:40:44) jabber: Recv (ssl)(1397): <iq id='purple267a717a' type='set'
 to='me' from='my friend'>
 <data xmlns='http://jabber.org/protocol/ibb' seq='1' sid='purple267a7176'>
 FTFfsOWgeAtyoZlOJ5pKHnKMsmU0lVYg8Kfq31U6qgKFhJQ
 KwcEp6NoiadtBwBCtT2KcZSAUSaQTyKnJ8pRfLzCegkcsbdWFwZOULS1LSoaT47TJlOC
 J7WyWqq9nlrcshoKCUIJzHM+Zsazd/e1pfWrgRmJ+4ZkCtoOYu7mW5nWTTo58GiBcihA
 faNL2J2Bu0fMRasNjarY2EQMhw4gTRuq0tQSJhZTWijOnurlCdRrJhxwl+CIxq3ZqQso
 WKSUneSQ4SSnbAz4BJTc9/ojkVORYG38DBMWSzG0oKbJEKYiE7Nd4wat12gFbc6wjwre
 heQFUypSEF1QcH8S0cQQw6PiDgHIlEK7hsK62iyUNQrqJlOCUESMe5AosdvxWcpSqMVt
 otrYFQuLkNhyU85wYVnRlhE27OsSptGczgXGVezTTziplMpqiZBJ57t1zkqUSG2qZlAx
 TsG41MwV2SU4xtA0lDLaRBolTddnxYpJSoEEWZJBsQd2ArRWC4YYVuSVhK0k6Gtmhqr8
 dJWNWh2EH1ZCrESA56sSLV8ElwKapGWyBtWdiZdsm8xtQMmy0BuOI4/hbVkxYFbakZaw
 kDJj9Hc3Ls5fVCYQu7NkF5SwdjUG1JKbbAwWIUkt0AMTQL+zxTFmXr8xB7Mw5+odSbfC
 kr6Z3npijOSmLToiA9XKJDM4+CRdmThskL41Q1y59gvaMWJ2JGRKeyQszieDOdMdHlCS
 IfJ0qDNl3Z2a1VPXcg88vWitB+Jl2ULGNPhlvZFlTzQ1bKsDqRe1Qqc7LIZyY+Rkhgz1
 CRoaDasQZnoIUJfTl4Rsr8ZflF0uZ12vGNFd9QcXvJnCo0MQxPr4XhRi11mKR2GTqFtm
 3QrB6zj6a23VWUeuMIYRPbMW0KXCNRVGai7YmxyVokJT+FTF/6RcDfxe0/pEU5eznLIU
 KDrx1aIZmxIOkLOIxu0J+rQzCJdIjsu5AdlQb5BscLkYxQIXaJbkEiEE5vefVkETPXBj
 kyTT9CdvS9RMgZY1h9w3MxImz/U7A5Lx7JmPROFaMVNEoLuXxxyKeYicQqpgpMDSFd/y
 g2+CiX2Mh08rGJmMh1qGdPU0utHxUIkLJaMbvBwcYZPoZQG5DJKxyQdInw6m3Oh1vFK2
 bRGAv0NqheblBhDypUYfEpr1TMSd2KJX024kzh4AqGauEhayQlI+n0ONLTeP/4u5Ipwo
 SD7LyxQA=</data></iq>
 (22:40:44) jabber: got 908 bytes of data on IBB stream
 (22:40:44) jabber: calling IBB callback for received data
 (22:40:44) jabber: about to write 908 bytes from IBB stream
 (22:40:44) xfer: Prpl (and UI) ready on ft 0x219548f0, so proceeding
 (22:40:44) jabber: jabber_si_xfer_free: destroying IBB session
 (22:40:44) jabber: IBB: destroying session 0x29e031a0 purple267a7176
 (22:40:44) jabber: Sending (ssl) (me): <iq type='set' id='purpleafaa4128'
 to='my friend'><close xmlns='http://jabber.org/protocol/ibb'
 sid='purple267a7176'/></iq>
 (22:40:44) jabber: jabber_si_xfer_free(): freeing jsx 0x21934360
 ==25203== Invalid read of size 2
 ==25203==    at 0x1DB12695: jabber_ibb_parse (ibb.c:455)
 ==25203==    by 0x1DB1C00A: jabber_process_packet (jabber.c:345)
 ==25203==    by 0x1DB28FA6: jabber_parser_element_end_libxml
 (parser.c:169)
 ==25203==    by 0x6345A92: ??? (in /usr/lib/libxml2.so.2.7.8)
 ==25203==    by 0x634C92F: ??? (in /usr/lib/libxml2.so.2.7.8)
 ==25203==    by 0x634E0A7: xmlParseChunk (in /usr/lib/libxml2.so.2.7.8)
 ==25203==    by 0x1DB2901C: jabber_parser_process (parser.c:279)
 ==25203==    by 0x1DB17E91: jabber_recv_cb_ssl (jabber.c:659)
 ==25203==    by 0x46E87D: pidgin_io_invoke (gtkeventloop.c:73)
 ==25203==    by 0x90044A2: g_main_context_dispatch (gmain.c:2440)
 ==25203==    by 0x9004C7F: g_main_context_iterate.clone.6 (gmain.c:3091)
 ==25203==    by 0x90052F1: g_main_loop_run (gmain.c:3299)
 ==25203==    by 0x679AA76: gtk_main (gtkmain.c:1256)
 ==25203==    by 0x435858: main (gtkmain.c:934)
 ==25203==  Address 0x29e031c2 is 34 bytes inside a block of size 112
 free'd
 ==25203==    at 0x4C268FE: free (in /usr/lib/valgrind/vgpreload_memcheck-
 amd64-linux.so)
 ==25203==    by 0x1DB2D7C6: jabber_si_xfer_free (si.c:1357)
 ==25203==    by 0x9319E11: purple_xfer_end (ft.c:1453)
 ==25203==    by 0x931A81A: do_transfer (ft.c:1262)
 ==25203==    by 0x1DB1268C: jabber_ibb_parse (ibb.c:442)
 ==25203==    by 0x1DB1C00A: jabber_process_packet (jabber.c:345)
 ==25203==    by 0x1DB28FA6: jabber_parser_element_end_libxml
 (parser.c:169)
 ==25203==    by 0x6345A92: ??? (in /usr/lib/libxml2.so.2.7.8)
 ==25203==    by 0x634C92F: ??? (in /usr/lib/libxml2.so.2.7.8)
 ==25203==    by 0x634E0A7: xmlParseChunk (in /usr/lib/libxml2.so.2.7.8)
 ==25203==    by 0x1DB2901C: jabber_parser_process (parser.c:279)
 ==25203==    by 0x1DB17E91: jabber_recv_cb_ssl (jabber.c:659)
 ==25203==    by 0x46E87D: pidgin_io_invoke (gtkeventloop.c:73)
 ==25203==    by 0x90044A2: g_main_context_dispatch (gmain.c:2440)
 ==25203==    by 0x9004C7F: g_main_context_iterate.clone.6 (gmain.c:3091)
 ==25203==    by 0x90052F1: g_main_loop_run (gmain.c:3299)
 ==25203==    by 0x679AA76: gtk_main (gtkmain.c:1256)
 ==25203==    by 0x435858: main (gtkmain.c:934)
 ==25203==
 }}}

--

Comment(by darkrain42):

 Just line-wrapping it (the unlinewrapped version is what was received; and
 this isn't relevant to the use-after-free)

-- 
Ticket URL: <http://developer.pidgin.im/ticket/14430#comment:1>
Pidgin <http://pidgin.im>
Pidgin


More information about the Tracker mailing list