software/RELEASES/ircservices/achurch.org/services/lists/ircservices/2004/004538.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
   2 <HTML>
   3  <HEAD>
   4    <TITLE> [IRCServices] Allocation error: ns unsuspend
   5    </TITLE>
   6    <LINK REL="Index" HREF="index.html" >
   7    <LINK REL="made" HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Allocation%20error%3A%20ns%20unsuspend&In-Reply-To=20040708194930.CMKR8778.mta02-svc.ntlworld.com%40excelsior">
   8    <META NAME="robots" CONTENT="index,nofollow">
   9    <META http-equiv="Content-Type" content="text/html; charset=us-ascii">
  10    <LINK REL="Previous"  HREF="004487.html">
  11    <LINK REL="Next"  HREF="004485.html">
  12  </HEAD>
  13  <BODY BGCOLOR="#ffffff">
  14    <H1>[IRCServices] Allocation error: ns unsuspend</H1>
  15     <B>Chawmp</B>
  16     <A HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Allocation%20error%3A%20ns%20unsuspend&In-Reply-To=20040708194930.CMKR8778.mta02-svc.ntlworld.com%40excelsior"
  17        TITLE="[IRCServices] Allocation error: ns unsuspend">chawmp at cyberarmy.net
  18        </A><BR>
  19     <I>Sun Jul 25 13:20:28 PDT 2004</I>
  20     <P><UL>
  21         <LI>Previous message: <A HREF="004487.html">[IRCServices] Seg Fault/Bus Error on SQUIT
  22 </A></li>
  23         <LI>Next message: <A HREF="004485.html">[IRCServices] Services 5.0.35 released
  24 </A></li>
  25          <LI> <B>Messages sorted by:</B>
  26               <a href="date.html#4538">[ date ]</a>
  27               <a href="thread.html#4538">[ thread ]</a>
  28               <a href="subject.html#4538">[ subject ]</a>
  29               <a href="author.html#4538">[ author ]</a>
  30          </LI>
  31        </UL>
  32     <HR>
  33 <!--beginarticle-->
  34 <PRE>Hi again,
  35
  36 I just noticed and patched another bug, quite similar to the last issue I
  37 posted about (&quot;Seg Fault/Bus Error on SQUIT&quot;:
  38 <A HREF="http://www.ircservices.za.net/pipermail/ircservices/2004/003377.html">http://www.ircservices.za.net/pipermail/ircservices/2004/003377.html</A> ).
  39
  40 Again, I noticed this one because free() is set up to write a pattern over
  41 memory as it is released on our services host. It wouldn't occur in most
  42 normal circumstances, but might do unpredictably, depending on a lot of
  43 factors, so ought to be fixed.
  44
  45 The problem occurs when unsuspending a nickname that is part of a group in
  46 which no nickname has been used for longer than the NSExpire setting - or
  47 something along those lines.
  48
  49 In modules/nickserv/util.c, unsuspend_nick() does this:
  50
  51         ARRAY_FOREACH (i, ngi-&gt;nicks) {
  52                 NickInfo *ni = get_nickinfo(ngi-&gt;nicks[i]);
  53                 ...
  54         }
  55
  56 get_nickinfo() will free (NickGroupInfo *)ngi under certain conditions
  57 (roughly as I described above), making the following attempts to dereference
  58 ngi crash the program:
  59
  60                 if (!ni) {
  61                         module_log(&quot;unsuspend: unable to retrieve NickInfo
  62 for %s&quot;
  63                                 &quot; (nick group %u)&quot;, ngi-&gt;nicks[i], ngi-&gt;id);
  64                         continue;
  65                 }
  66
  67 ngi would also be used in subsequent loops, so just changing the log message
  68 wouldn't be a solution.
  69
  70 I didn't have a lot of time to investigate the best way to fix this, but
  71 here is the patch I came up with. It seems to do the job, but I would be
  72 grateful if anyone can advise something more suitable. (Lines beginning &quot;+&quot;
  73 were added; noexpire is just set to 1 before the loop, and restored
  74 afterwards, which stops the expiry check. Note that the NSSuspendGrace stuff
  75 only happens a few lines after the call to get_nickinfo(), so for that small
  76 time, nick groups can disappear.).
  77
  78   void unsuspend_nick(NickGroupInfo *ngi, int set_time)
  79   {
  80       time_t now = time(NULL);
  81 + int cache_noexpire = 0;
  82
  83       if (!ngi-&gt;suspendinfo) {
  84         module_log(&quot;unsuspend: called on non-suspended nick group %u [%s]&quot;,
  85
  86 ...
  87
  88                        &quot; %u) to %ld&quot;, ngi-&gt;nicks[ngi-&gt;mainnick], ngi-&gt;id,
  89                        (long)ngi-&gt;authset);
  90         }
  91 + cache_noexpire = noexpire;
  92 + noexpire = 1;
  93         ARRAY_FOREACH (i, ngi-&gt;nicks) {
  94             NickInfo *ni = get_nickinfo(ngi-&gt;nicks[i]);
  95             if (!ni) {
  96
  97 ...
  98
  99             }
 100         }
 101       }
 102 + noexpire = cache_noexpire;
 103   }
 104
 105
 106 /*************************************************************************/
 107
 108 --
 109 Tom McIntyre
 110 <A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">chawmp at cyberarmy.net</A>
 111
 112
 113
 114
 115 </PRE>
 116
 117 <!--endarticle-->
 118     <HR>
 119     <P><UL>
 120         <!--threads-->
 121         <LI>Previous message: <A HREF="004487.html">[IRCServices] Seg Fault/Bus Error on SQUIT
 122 </A></li>
 123         <LI>Next message: <A HREF="004485.html">[IRCServices] Services 5.0.35 released
 124 </A></li>
 125          <LI> <B>Messages sorted by:</B>
 126               <a href="date.html#4538">[ date ]</a>
 127               <a href="thread.html#4538">[ thread ]</a>
 128               <a href="subject.html#4538">[ subject ]</a>
 129               <a href="author.html#4538">[ author ]</a>
 130          </LI>
 131        </UL>
 132
 133 </body></html>