KaVir protocol snippet

Posted by Lerkista on Tue 31 Mar 2020 08:04 AM — 15 posts, 50,797 views.

Lerkista Tue 31 Mar 2020 08:04 AM #0

Hi

I've installed it, and have some segmentation faults

I've read this post:

https://www.gammon.com.au/forum/?id=12367

And it needs to change the malloc calls, but i can't figured how to make it work

here is the snippet:

https://github.com/Xavious/MSDP_Protocol_Handler

i get this errors:

make -s smaug
  Compiling o/protocol.o....
protocol.c: In function protocol_t* ProtocolCreate():
protocol.c:294:22: error: invalid conversion from void* to protocol_t* [-fpermissive]
    pProtocol = malloc(sizeof(protocol_t));
                ~~~~~~^~~~~~~~~~~~~~~~~~~~
protocol.c:318:34: error: invalid conversion from void* to MSDP_t** [-fpermissive]
    pProtocol->pVariables = malloc(sizeof(MSDP_t*)*eMSDP_MAX);
                            ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
protocol.c:322:40: error: invalid conversion from void* to MSDP_t* [-fpermissive]
       pProtocol->pVariables[i] = malloc(sizeof(MSDP_t));
                                  ~~~~~~^~~~~~~~~~~~~~~~
make[1]: *** [Makefile:106: o/protocol.o] Error 1
make: *** [Makefile:49: all] Error 2

i've changed this:

Line 294:

from

pProtocol = malloc(sizeof(protocol_t));

pProtocol = new protocol_t[sizeof(protocol_t)];

Line 318:

from

pProtocol->pVariables = malloc(sizeof(MSDP_t*)*eMSDP_MAX);

pProtocol->pVariables = new MSDP_t*[eMSDP_MAX * sizeof(MSDP_t)];

Line 322:

from

pProtocol->pVariables[i] = malloc(sizeof(MSDP_t));

pProtocol->pVariables[i] = new MSDP_t[sizeof(MSDP_t)];

I get no errors when compiling, but when i run the mud and try to enter at the login prompt i get a segmentation fault, using gdb the error seems when pProtocol->pVariables is going to be used

gdb:

#0  __GI_strcmp (p1=0x0, p2=0x1c4cfc "Unknown") at strcmp.c:38
#1  0x0019b138 in PerformSubnegotiation (aSize=<optimized out>, 
    apData=0x57dadd <ProtocolInput(descriptor_data*, char*, int, char*)::IacBuf+1> "", 
    aCmd=<optimized out>, apDescriptor=0x755f7974) at protocol.c:2031
#2  ProtocolInput (apDescriptor=0x755f7974, apDescriptor@entry=0x1780408, 
    apData=apData@entry=0x24f494 <read_from_descriptor(descriptor_data*)::read_buf> "\377\372\030", 
    aSize=aSize@entry=41, apOut=0x7265646e <error: Cannot access memory at address 0x7265646e>, 
    apOut@entry=0x178043d "") at protocol.c:399
#3  0x000af570 in read_from_descriptor (d=d@entry=0x1780408) at comm.c:1442
#4  0x000b6190 in game_loop () at comm.c:870
#5  0x000b69a4 in main (argc=2, argv=0x7e813234) at comm.c:578

line 2031 in protocol.c:

if ( !strcmp(pProtocol->pVariables[eMSDP_CLIENT_ID]->pValueString, "Unknown") )

Any one have installed this snipping and make it working?

Thanks

Nick Gammon Australia Forum Administrator Tue 31 Mar 2020 08:08 PM #1

This looks wrong, somehow:


pProtocol->pVariables = new MSDP_t*[eMSDP_MAX * sizeof(MSDP_t)];

pProtocol->pVariables seems to be a pointer to an array of pointers.

When you do a "new" for an array, the thing in the brackets should be the count of the number of array items. You seem to be putting the size of the item (MSDP_t) into the array count.

You are probably better off changing the original code to cast the malloc so that you don't get the errors, eg.


    pProtocol = (protocol_t*) malloc(sizeof(protocol_t));
...
    pProtocol->pVariables = (MSDP_t**) malloc(sizeof(MSDP_t*)*eMSDP_MAX);
...
    pProtocol->pVariables[i] = (MSDP_t*) malloc(sizeof(MSDP_t));

This doesn't solve the problem with your code, but it should compile now.

Lerkista Wed 01 Apr 2020 12:13 AM #2

Hi

Yeah, it compiles, but the segmentation fault continues, i´m lost, don´t know how to fix it

My source have installed many snippets, overland, houses, lua,trivia, bank, remort, etc

I don´t want to try to start again adding snippets to a clean source

So anyone can please check the source and try to find the error?

Here is the link:

https://www.dropbox.com/s/43f9p6k38xwc3km/CaguaMudError.tgz?dl=0

I run it in Raspbian, as i know maybe the only change needed to make is changing the liblua.a in src for one compiled in your distro

Thanks

Nick Gammon Australia Forum Administrator Wed 01 Apr 2020 07:08 AM #3

I suggest you work through my debugging page: http://www.gammon.com.au/gdb

You have a backtrace, that's great! Now type "list" to see the code being executed (see the link above for more details).

You can try to work out if you are dereferencing a NULL pointer, or maybe memory got corrupted.

Fiendish USA Global Moderator Wed 01 Apr 2020 04:19 PM #4

Quote:
the error seems when pProtocol->pVariables is going to be used

No, that's wrong. The error is in strcmp, which means after pProtocol->pVariables[eMSDP_CLIENT_ID]->pValueString is evaluated. The problem per the last line (#0) in your stack trace is that pValueString is null (p1=0x0).

pValueString is supposed to be set in https://github.com/Xavious/MSDP_Protocol_Handler/blob/b7502027842c7cac3013555734d8297f10626eb6/protocol.c#L425

But you've modified your version of AllocString so that it always returns NULL because it no longer mallocs the pResult char array. Don't do that.

Lerkista Wed 01 Apr 2020 07:02 PM #5

Hi

Yeah, i don´t remember when or why but my AllocString function have lines missing from the original, that was the problem

Now it works, not as i want but at least is playable, they´re some details like a extra carriage returns when asking login and password, i want:

...enter your login: Lerkista
...password: *here the cursor to enter password*

but i get

...enter your login:


Lerkista
...password:
*here the cursor to enter password*

But i think has something to do with the negotiation that the extra returns are added

Thanks

Lerkista Thu 02 Apr 2020 02:10 PM #6

Hi

I´ve another problem with this snippet

When i log in and log out i get a abort error:

Thu Apr  2 02:44:36 2020 :: Lerkista se ha salido (Room 10300).
Thu Apr  2 02:44:38 2020 :: Cerrando cuenta: Lerkista
munmap_chunk(): invalid pointer
Aborted

This is the error in gdb:

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) list
45      in ../sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x76b6e230 in __GI_abort () at abort.c:79
#2  0x76bbe51c in __libc_message (action=action@entry=do_abort,
    fmt=<optimized out>) at ../sysdeps/posix/libc_fatal.c:181
#3  0x76bc5044 in malloc_printerr (str=<optimized out>) at malloc.c:5341
#4  0x76bc5658 in munmap_chunk (p=<optimized out>) at malloc.c:2830
#5  0x00199be8 in ProtocolDestroy (apProtocol=0x2211098) at protocol.c:356
#6  0x000b2b50 in close_socket (dclose=dclose@entry=0x2210420,
    force=force@entry=false) at comm.c:1378
#7  0x0018f098 in account_nanny (d=d@entry=0x2210420,
    argument=0x7eef1cf0 "salir", argument@entry=0x7eef1ce8 "")
    at account.c:1101
#8  0x000b6400 in game_loop () at comm.c:933
#9  0x000b69ac in main (argc=2, argv=0x7eef2284) at comm.c:578
(gdb)

The problem is with this function:

void ProtocolDestroy( protocol_t *apProtocol )
{
   int i; /* Loop counter */

   for ( i = eMSDP_NONE+1; i < eMSDP_MAX; i++ )
   {
      free(apProtocol->pVariables[i]->pValueString);
      free(apProtocol->pVariables[i]);          //Here is the problem
   }
   free(apProtocol->pVariables);
   free(apProtocol->pLastTTYPE);
   free(apProtocol->pMXPVersion);
   free(apProtocol);
}

Any idea on how to prevent it?

That array is declared like this:

   for ( i = eMSDP_NONE+1; i < eMSDP_MAX; ++i )
   {
      pProtocol->pVariables[i] = (MSDP_t*) malloc(sizeof(MSDP_t));
      pProtocol->pVariables[i]->bReport = false;
      pProtocol->pVariables[i]->bDirty = false;
      pProtocol->pVariables[i]->ValueInt = 0;
      pProtocol->pVariables[i]->pValueString = NULL;
........

Thanks

Fiendish USA Global Moderator Thu 02 Apr 2020 02:55 PM #7

Quote:
//Here is the problem

The trace says the problem is on line 356. That isn't line 356 in the code you shared earlier.

Lerkista Thu 02 Apr 2020 03:29 PM #8

Hi

Sorry, i was using another copy of the source, this is the one i uploaded before with the AllocString fix:

https://www.dropbox.com/s/43f9p6k38xwc3km/CaguaMudError.tgz?dl=0

This is the corect gdb output based in this source:

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x76b80230 in __GI_abort () at abort.c:79
#2  0x76bd051c in __libc_message (action=action@entry=do_abort, fmt=<optimized out>)
    at ../sysdeps/posix/libc_fatal.c:181
#3  0x76bd7044 in malloc_printerr (str=<optimized out>) at malloc.c:5341
#4  0x76bd7658 in munmap_chunk (p=<optimized out>) at malloc.c:2830
#5  0x00199bb8 in ProtocolDestroy (apProtocol=0x1382670) at protocol.c:353
#6  0x000b2b50 in close_socket (dclose=dclose@entry=0x13826b0, force=force@entry=false)
    at comm.c:1378
#7  0x0018f068 in account_nanny (d=d@entry=0x13826b0, argument=0x7ee6fcf0 "salir",
    argument@entry=0x7ee6fce8 "") at account.c:1101
#8  0x000b63f8 in game_loop () at comm.c:933
#9  0x000b69a4 in main (argc=2, argv=0x7ee70284) at comm.c:578

Thanks

Fiendish USA Global Moderator Thu 02 Apr 2020 05:25 PM #9

I don't know, but I see a bunch of unexplained differences between your protocol.c and the one at https://github.com/scandum/msdp_protocol_snippet_by_kavir which appears to be newer.

Lerkista Thu 02 Apr 2020 05:46 PM #10

Hi

Ok, i'm going to check it, the one you mention was uploaded just 5 days ago

The one i based was from 5 years ago, and plus all the additions from the other snippets, maybe that´s the reason for the changes you mention

Thanks

Lerkista Fri 03 Apr 2020 10:45 PM #11

Hi

Ok, i fixed that problem, but there´s another one

Here´s the updated source:

https://www.dropbox.com/s/8lp3miqlxpdrr4s/CaguaMudError.tgz?dl=0

The problem is with Hotboot, i get a segmentation fault, here is the gdb output:

Core was generated by `smaug 6660 hotboot 3 -1'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000b2e90 in write_to_buffer (d=d@entry=0x2530780,
    txt=0x24b2e8 <colorize(char const*, descriptor_data*)::result> "\033[0;37m",
    length=<optimized out>, length@entry=0) at comm.c:1769
1769        if ( d->pProtocol->WriteOOB > 0 )         /* <--- Add this line */
(gdb) bt
#0  0x000b2e90 in write_to_buffer (d=d@entry=0x2530780,
    txt=0x24b2e8 <colorize(char const*, descriptor_data*)::result> "\033[0;37m",
    length=<optimized out>, length@entry=0) at comm.c:1769
#1  0x000ac0fc in send_to_desc_color (txt=<optimized out>, d=0x2530780) at color.c:1470
#2  0x000ac13c in send_to_char (txt=<optimized out>, ch=ch@entry=0x2532e50) at color.c:1485
#3  0x000b1168 in act (AType=AType@entry=45,
    format=0x2 <error: Cannot access memory at address 0x2>,
    format@entry=0x1ec5c0 "Una nube de humo etereo se disipa a tu alrededor!", ch=0x2532e50,
    arg1=0x2532e50, arg1@entry=0x0, arg2=arg2@entry=0x0, type=type@entry=4) at comm.c:3794
#4  0x000ef360 in hotboot_recover () at hotboot.c:833
#5  0x000b6970 in main (argc=5, argv=0x7ed89274) at comm.c:573

This error is when the act() function is called after the hotboot, if i comment both act() calls in hotboot:c833 and 834, the error comes from log_string() in line 852

I´m lost with this error

Any help?

Thanks

Lerkista Wed 08 Apr 2020 11:59 PM #12

Hi

Ok, i´ve fixed this error, it was a missing "d->pProtocol = ProtocolCreate();" in hotboot_recover (after d->prevcolor = 0x08;), it was not in the snippet instructions

Nick Gammon Australia Forum Administrator Thu 09 Apr 2020 03:42 AM #13

Thanks for letting us know. Can you state exactly where you added that, to help others in the future?

Lerkista Thu 09 Apr 2020 03:40 PM #14

Hi

In my code was in hotboot.c line 794

in function hotboot_recover where the d descriptor is initialized

after

d->prevcolor = 0x08;

and before

d->ifd = -1;