Hi
We have experimental JSR-82 module that is directly bound to libbluetooth.so
svn http://bluecove.googlecode.com/svn/bluecove-gpl/trunk
Don't worry we also working D-Bus bound module as well....
Now we just found a small problem in bluez sdp.c. When we are
creating service record that contains SDP_SEQ and its (SEQ) binary
size more then 254 bytes we get *** stack smashing detected *** error.
For tests SDP_SEQ containing 253 Null elements has been used.
Stack: [0xb512f000,0xb5180000), sp=0xb517e930, free space=318k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libbluetooth.so.2+0xace2] sdp_append_to_buf+0x22
C [libbluetooth.so.2+0xde08] sdp_append_to_pdu+0x98
My entry point to the library is sdp_extract_pdu
Tested on Fedora 7 2.6.21 i386, bluez-libs 3.9
I was looking at the source code for sdp.c 3.25 and can't see any
related changes.
The code creating the test is in java and it call function in
BlueCoveBlueZ_Tests.c
How should I approach to fix this bluez?
Regards,
Vlad
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel
Just to make it clear this is the versions.
[root@tor bluez-libs-tests]# gcc --version
gcc (GCC) 4.1.2 20070925 (Red Hat 4.1.2-27)
[root@tor bluez-libs-tests]# uname -a
Linux torv 2.6.21-6.fc7xen #1 SMP Mon Nov 19 07:14:27 EST 2007 i686
i686 i386 GNU/Linux
[root@tor bluez-libs-tests]# ldd ./target/bluez-tests
linux-gate.so.1 => (0x00762000)
libbluetooth.so.2 => /usr/lib/libbluetooth.so.2 (0x00233000)
libc.so.6 => /lib/i686/nosegneg/libc.so.6 (0x002b1000)
[root@tor bluez-libs-tests]# file /usr/lib/libbluetooth.so.2
/usr/lib/libbluetooth.so.2: symbolic link to `libbluetooth.so.2.9.4'
[root@tor bluez-libs-tests]# file /usr/lib/libbluetooth.so.2.9.4
/usr/lib/libbluetooth.so.2.9.4: ELF 32-bit LSB shared object, Intel
80386, version 1 (SYSV), not stripped
--
Vlad
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel
In fact I used default Fedora 7 and it has bluez-libs 3.9
(libbluetooth.so.2.5.0)
I did source comparison with current sdp.c from bluez-libs 3.25 and I
was not able to see any changer related to this. So I blindly assumed
this may be a bug.
Once bluez-libs 3.25 installed (libbluetooth.so.2.9.4) the original
test works fine but when I change the number of records to 215 I get
the same error. BUT not every run!!!!
--- start testing SDP convenrsions ---
create SEQ of 215 elements
call sdp_attr_add
call sdp_gen_record_pdu
pdu.data_size 438
call sdp_extract_pdu
pdu scanned 438
OK
--- tests finished ---
--- start testing SDP convenrsions ---
create SEQ of 215 elements
call sdp_attr_add
call sdp_gen_record_pdu
make: *** [run] Segmentation fault
If I have #define TEST_SEQ_SIZE 128 (On bluez-libs 3.25 )
When I run the test if fails every 10-th run.
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel
Hi Vlad,
> I create a small test in C bluez-sdp-tests.c
> Source code there: http://snapshot.bluecove.org/bluecove-gpl/bluez/test/
what compiler/libc options/versions did you used for bluez-libs and for
the test program?
Regards
Marcel
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel
Hi Bastien,
> > I create a small test in C bluez-sdp-tests.c
> > Source code there: http://snapshot.bluecove.org/bluecove-gpl/bluez/test/
> >
> > If the SDP binary size is 258 bytes still works OK.
> > But when I make it bigger call to sdp_gen_record_pdu will crash.
>
> Works fine here, no errors from valgrind either. You might want to
> upgrade your bluez-libs...
a Fedora 8 with an older bluez-libs indeed crashes:
--- start testing SDP convenrsions ---
create SEQ of 126 elements
call sdp_attr_add
call sdp_gen_record_pdu
*** stack smashing detected ***: ./bluez-sdp-tests terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x6c)[0xf2edf7c]
/lib/libc.so.6[0xf2edf08]
/usr/lib/libbluetooth.so.2(_savefpr_14+0x0)[0xffa28b4]
/usr/lib/libbluetooth.so.2[0xffa140c]
/usr/lib/libbluetooth.so.2[0xffa1440]
/usr/lib/libbluetooth.so.2(sdp_gen_record_pdu+0x7c)[0xff9d66c]
./bluez-sdp-tests[0x10001880]
./bluez-sdp-tests[0x100019b0]
/lib/libc.so.6[0xf1fe56c]
/lib/libc.so.6[0xf1fe73c]
======= Memory map: ========
00100000-00103000 r-xp 00100000 00:00 0 [vdso]
0f1e0000-0f35f000 r-xp 00000000 03:03 1081363 /lib/libc-2.7.so
0f35f000-0f36c000 ---p 0017f000 03:03 1081363 /lib/libc-2.7.so
0f36c000-0f370000 r--p 0018c000 03:03 1081363 /lib/libc-2.7.so
0f370000-0f371000 rw-p 00190000 03:03 1081363 /lib/libc-2.7.so
0f371000-0f374000 rw-p 0f371000 00:00 0
0ff90000-0ffa9000 r-xp 00000000 03:03 2894543 /usr/lib/libbluetooth.so.2.9.0
0ffa9000-0ffb8000 ---p 00019000 03:03 2894543 /usr/lib/libbluetooth.so.2.9.0
0ffb8000-0ffba000 rw-p 00018000 03:03 2894543 /usr/lib/libbluetooth.so.2.9.0
0ffc0000-0ffe0000 r-xp 00000000 03:03 1081360 /lib/ld-2.7.so
0ffef000-0fff0000 r--p 0002f000 03:03 1081360 /lib/ld-2.7.so
0fff0000-0fff1000 rw-p 00030000 03:03 1081360 /lib/ld-2.7.so
10000000-10003000 r-xp 00000000 03:06 3604654 /home/holtmann/bluez-sdp-tests
10012000-10013000 rw-p 00002000 03:06 3604654 /home/holtmann/bluez-sdp-tests
10013000-10034000 rwxp 10013000 00:00 0 [heap]
30013000-30016000 rw-p 30013000 00:00 0
7fa30000-7fa45000 rw-p 7ffeb000 00:00 0 [stack]
Aborted
However installing the bluez-libs-3.25 I don't see it anymore:
--- start testing SDP convenrsions ---
create SEQ of 126 elements
call sdp_attr_add
call sdp_gen_record_pdu
pdu.data_size 260
call sdp_extract_pdu
pdu scanned 260
OK
--- tests finished ---
Regards
Marcel
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel
On Thu, 2008-02-07 at 13:25 -0500, Vlad Skarzhevskyy wrote:
> Hi Marcel
> I create a small test in C bluez-sdp-tests.c
> Source code there: http://snapshot.bluecove.org/bluecove-gpl/bluez/test/
>
> If the SDP binary size is 258 bytes still works OK.
> But when I make it bigger call to sdp_gen_record_pdu will crash.
Works fine here, no errors from valgrind either. You might want to
upgrade your bluez-libs...
Cheers
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel
Hi Marcel
I create a small test in C bluez-sdp-tests.c
Source code there: http://snapshot.bluecove.org/bluecove-gpl/bluez/test/
If the SDP binary size is 258 bytes still works OK.
But when I make it bigger call to sdp_gen_record_pdu will crash.
===================TEST_SEQ_SIZE 125=========================
--- start testing SDP convenrsions ---
create SEQ of 125 elements
call sdp_attr_add
call sdp_gen_record_pdu
pdu.data_size 258
call sdp_extract_pdu
pdu scanned 258
OK
--- tests finished ---
===================TEST_SEQ_SIZE 126=========================
--- start testing SDP convenrsions ---
create SEQ of 126 elements
call sdp_attr_add
call sdp_gen_record_pdu
*** stack smashing detected ***: target/bluez-tests terminated
make: *** [run] Aborted
Regards,
Vlad
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel
Hi Vlad,
> We have experimental JSR-82 module that is directly bound to libbluetooth.so
> svn http://bluecove.googlecode.com/svn/bluecove-gpl/trunk
>
> Don't worry we also working D-Bus bound module as well....
>
> Now we just found a small problem in bluez sdp.c. When we are
> creating service record that contains SDP_SEQ and its (SEQ) binary
> size more then 254 bytes we get *** stack smashing detected *** error.
>
> For tests SDP_SEQ containing 253 Null elements has been used.
>
> Stack: [0xb512f000,0xb5180000), sp=0xb517e930, free space=318k
> Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
> C [libbluetooth.so.2+0xace2] sdp_append_to_buf+0x22
> C [libbluetooth.so.2+0xde08] sdp_append_to_pdu+0x98
>
> My entry point to the library is sdp_extract_pdu
>
> Tested on Fedora 7 2.6.21 i386, bluez-libs 3.9
>
> I was looking at the source code for sdp.c 3.25 and can't see any
> related changes.
>
> The code creating the test is in java and it call function in
> BlueCoveBlueZ_Tests.c
>
> How should I approach to fix this bluez?
can you write a quick example in C that would trigger this problem. I
don't see the issue right now. Have to get it through a debugger.
Regards
Marcel
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel