Subject: errors in external programs with wuftpd; testing ftpd

From: Albert Lunde <[email-masked]>
Date: Mon, 27 Jan 1997 18:01:29 -0600

[also mailed to [email-masked]]

I'm getting a lot of errors in my logs like:
>Jan 27 16:14:56 pubweb ftpd[22189]: exiting on signal 10
>Jan 27 16:17:25 pubweb ftpd[22288]: exiting on signal 11

On HPUX 10 these are a "bus error" or a "segmentation fault". All I've
looked at in detail seem to involve running external programs like ls or
site exec commands.

Going from beta 11 to beta 12 made things worse.

(I'm using hpux 10.20 on an hp 9000/780, with some local mods to make the
code compile under 10.20.)

Under my local version of beta 12, I was able to get the command "site exec
quota -v" to fail when I just ftped in and ran it without doing something
else.

However, I'm a bit at a loss as to how I can get debugging information to
narrow down the source of the problem. (I know this is a very ill-defined
problem). We normally don't want the ftpd or its children to dump core on
an error. I'm also not sure I can run the whole thing under a debugger.

I tried writing a test wrapper to run the popen.c code independent of the
whole ftpd, but I couldn't get the problem to recur in that case.

One issue I'm concerned about re testing: the FAQ suggests running a test
server on a different port. If I do this, do I need to specify a different
path for the pid files to avoid interference?

---
    Albert Lunde                      [email-masked]

---

From: Alain Magloire <[email-masked]>
Date: Wed, 29 Jan 1997 20:06:45 -0500 (EST)

> quota -v" to fail when I just ftped in and ran it without doing something

Well there is a buffer overflow problem in ftpd_popen() 
for exemple if you try

site exec 'a a a a a a a a a a ....'

where the number of 'a's goes over 100 the server will SIGVEC.

However you should watch that the SIGVEC is not on you ftp client
some clients uses gets() or similar to handle arguments, or 
a misconfiguration os SITE EXEC.

Simply trace(1) the server and see if it's crashing.

I included below a patch for beta-12 ... I think beta-13
will be immune.

If the server still crash after that, you should investigate furter
keep me posted

To apply, 
cd wu-ftpd-2.4.2-beta-12/src; patch < patch_file
-- 
Bonne anne'e, alain

#########cut here#
*** ./popen.c.orig	Wed Jan 22 18:02:00 1997
--- ./popen.c	Wed Jan 22 18:05:35 1997
***************
*** 48,53 ****
--- 48,56 ----
  #include <sys/resource.h>
  #endif
  
+ #define MAX_ARGC 100
+ #define MAX_GARGC 1000
+ 
  /* 
   * Special version of popen which avoids call to shell.  This insures noone
   * may create a pipe to a hidden program as a side effect of a list or dir
***************
*** 73,80 ****
        pdes[2],
        pid,i;
      char **pop,
!      *argv[100],
!      *gargv[1000],
       *vv[2];
  #ifdef __STDC__
      extern char **ftpglob(register char *v),
--- 76,83 ----
        pdes[2],
        pid,i;
      char **pop,
!      *argv[MAX_ARGC],
!      *gargv[MAX_GARGC],
       *vv[2];
  #ifdef __STDC__
      extern char **ftpglob(register char *v),
***************
*** 120,131 ****
          return (NULL);
  
      /* break up string into pieces */
!     for (argc = 0, cp = program;; cp = NULL)
          if (!(argv[argc++] = strtok(cp, " \t\n")))
              break;
  
!         if (argc > 100) return(NULL); /* AUSCERT Report */
! 
      /* glob each piece */
      gargv[0] = argv[0];
      for (gargc = argc = 1; argv[argc]; argc++) {
--- 123,134 ----
          return (NULL);
  
      /* break up string into pieces */
!     for (argc = 0, cp = program;; cp = NULL) {
          if (!(argv[argc++] = strtok(cp, " \t\n")))
              break;
  
!         if (argc > MAX_ARGC) return(NULL); /* AUSCERT Report */
!     }
      /* glob each piece */
      gargv[0] = argv[0];
      for (gargc = argc = 1; argv[argc]; argc++) {
***************
*** 135,141 ****
              pop = copyblk(vv);
          }
          argv[argc] = (char *) pop;  /* save to free later */
!         while (*pop && gargc < 1000)
              gargv[gargc++] = *pop++;
      }
      gargv[gargc] = NULL;
--- 138,144 ----
              pop = copyblk(vv);
          }
          argv[argc] = (char *) pop;  /* save to free later */
!         while (*pop && gargc < MAX_GARGC)
              gargv[gargc++] = *pop++;
      }
      gargv[gargc] = NULL;
*** ./access.c.orig	Wed Jan 22 18:51:45 1997
--- ./access.c	Wed Jan 22 19:38:26 1997
***************
*** 72,77 ****
--- 72,79 ----
  static  char  incline[MAXLINE];
  int pidfd = -1;
  
+ #define MAX_LOCKWAIT 300
+ 
  extern int fnmatch();
  
  /*************************************************************************/
***************
*** 578,584 ****
                 strerror(errno));
          return -1;
      }
! 
  #ifdef HAVE_FLOCK
      while (flock(pidfd, LOCK_EX)) {
          syslog(LOG_ERR, "sleeping: flock of pid file failed: %s",
--- 580,587 ----
                 strerror(errno));
          return -1;
      }
!  
!     count = 0;
  #ifdef HAVE_FLOCK
      while (flock(pidfd, LOCK_EX)) {
          syslog(LOG_ERR, "sleeping: flock of pid file failed: %s",
***************
*** 589,594 ****
--- 592,602 ----
  		syslog(LOG_ERR, "sleeping: fcntl lock of pid file failed: %s",
  #endif
                 strerror(errno));
+         if (count > MAX_LOCKWAIT) {
+           syslog(LOG_ERR, "%s:bailing out of loop", "acl_countusers");
+           dologout(-1);
+         }
+         count++;
          sleep(1);
      }
      lseek(pidfd, 0, L_SET);
***************
*** 650,655 ****
--- 658,664 ----
          return;
      }
  
+     avail = 0;
  #ifdef HAVE_FLOCK
      while (flock(pidfd, LOCK_EX)) {
          syslog(LOG_ERR, "sleeping: flock of pid file failed: %s",
***************
*** 660,665 ****
--- 669,679 ----
          syslog(LOG_ERR, "sleeping: fcntl lock of pid file failed: %s",
  #endif
                 strerror(errno));
+         if (avail > MAX_LOCKWAIT) {
+           syslog(LOG_ERR, "%s:bailing out of loop", "acl_join");
+           dologout(-1);
+         }
+         avail++;
          sleep(1);
      }
  
***************
*** 745,750 ****
--- 759,765 ----
          return;
      }
  
+     avail = 0;
  #ifdef HAVE_FLOCK
      while (flock(pidfd, LOCK_EX)) {
          syslog(LOG_ERR, "sleeping: flock of pid file failed: %s",
***************
*** 755,761 ****
--- 770,782 ----
          syslog(LOG_ERR, "sleeping: fcntl lock of pid file failed: %s",
  #endif
                 strerror(errno));
+         if (avail > MAX_LOCKWAIT) {
+           syslog(LOG_ERR, "%s:bailing out of loop", "acl_remove");
+           dologout(-1);
+         }
+         avail++;
          sleep(1);
+     
      }
  
      procid = getpid();

---

From: Albert Lunde <[email-masked]>
Date: Thu, 30 Jan 1997 12:04:18 -0600

I got this advice from David Capshaw:

>When running wu-ftpd beta 11 on HP-UX 10.10 I encountered a number
>of problems with signal 11 type failures until I added
>    #define HAVE_GETRLIMIT
>to src/config/config.hpx
>
>I believe that the problem was that otherwise the file descriptor
>indexed array used in the popen routine was being set to a small size
>so that when programs were run (e.g. ls) there would often be memory
>corruption later causing a malloc failure.
>
>The system include files with HP-UX 9 were different so this problem
>did not arrise there.

I added this mod to my version of the beta 12 source and the signal 10 and
signal 11 errors in my logs went away. It's been running a full day with no
such errors, after having a few hundred per day before that.

---

---

From: Paradise Cowgirl <[email-masked]>
Date: Thu, 30 Jan 1997 10:36:33 -0800 (PST)

Hello,

Is it possible to download a static version of ls for Solaris 2.5 from
somewhere? I have tried without success to get the dynamic version working
(I combed the Dec/Jan archives, the guest-howto and the faq and seem to
have ended up in the same place as [email-masked]).

I've tried compiling a static-l from the gnu fileutils (v3.13) with the
patch posted here applied but get a bunch of ldd errors at link time. 

I'm in the process of downloading and building gnu gcc v2.7.2.1 but
in the meantime, I NEED to get wu-ftpd up and working for anon and
guestgroup users! :-)

In return, I promise to provide a complete HOWTO document for Solaris
2.5.x :-) for wu-ftpd, anon and guestgroup setup and make it available via
the web. Hopefully so the next person doesn't have to spend two days
piecing all the info together from various sources :-)

Thanks so much!

Cheers,
Darci Chapman ([email-masked])
--
            "the days run away like horses over the hills"
	               To the motion be true.
          Everything is on its way to somewhere. Everything.

---

From: Subu Rama <[email-masked]>
Date: Thu, 30 Jan 1997 13:30:40 -0500 (EST)

All I could find was wu-ftpd 2.4 from ftp.wustl.edu and the README says
no more development is being made.

I see messages in this list referring to Beta 10 and Beta 11. What are
these and where can I get them ? (Are they in the academ directory ?
What are the differences between the academ version and the 2.4 version ?)

Thank you

Subu Rama
[email-masked]

---

From: Yanni <[email-masked]>
Date: Thu, 30 Jan 1997 12:44:49 -0800

On Thu, Jan 30, 1997 at 10:36:33 AM, Paradise Cowgirl <minerva@
teleport.com> wrote:

> I'm in the process of downloading and building gnu gcc v2.7.2.1 but in 

why?

ftp://opcom.sun.ca/pub/freeware/

pkgadd -d gcc-2.7.2.1

-jon

Jon (no h) S. Stevens     [email-masked]
ClearInk WebMagus         http://www.clearink.com/
finger [email-masked] for pgp pub key
ClearlyHome - MultiHoming for Mac WebServers
http://www.clearink.com/fun_stuff/plugins/
The Internet Weather Report
http://www.internetweather.com/
Jobs! - http://www.clearink.com/

---

From: Vidiot <[email-masked]>
Date: Thu, 30 Jan 1997 14:11:30 -0600 (CST)

<Is it possible to download a static version of ls for Solaris 2.5 from
<somewhere? I have tried without success to get the dynamic version working
<(I combed the Dec/Jan archives, the guest-howto and the faq and seem to
<have ended up in the same place as [email-masked]).
<
<I've tried compiling a static-l from the gnu fileutils (v3.13) with the
<patch posted here applied but get a bunch of ldd errors at link time. 
<
<I'm in the process of downloading and building gnu gcc v2.7.2.1 but
<in the meantime, I NEED to get wu-ftpd up and working for anon and
<guestgroup users! :-)
<
<In return, I promise to provide a complete HOWTO document for Solaris
<2.5.x :-) for wu-ftpd, anon and guestgroup setup and make it available via
<the web. Hopefully so the next person doesn't have to spend two days
<piecing all the info together from various sources :-)
<
<Darci Chapman ([email-masked])

I don't get it.  I compiled with GNU 2.7.2 under Solaris 2.5.1 on a Ultra 140.
The ls command functions as expected.  I just discovered yesterday that the
dir command does not work and have to find out why.  Maybe it is the dir
command that needs the static compile, while ls doesn't.

I'm confused.

MB
-- 
System Administrator - Finnigan FT/MS - Madison WI. <URL:http://www.ftms.com/>
e-mail: [email-masked]
phone: (608) 273-8262 ext: 612  fax: (608) 273-8719
Visit - <URL:http://www.cdsnet.net/vidiot/>  (Your link to Star Trek and UPN)

---

From: Paradise Cowgirl <[email-masked]>
Date: Thu, 30 Jan 1997 12:31:08 -0800 (PST)

> command that needs the static compile, while ls doesn't.

Sorry about not being specific - I've been staring it for too long, I
think :-)

"ls" works fine; dir does not map the gid/uid numbers to the names. I'm
in touch with someone who has got the dynamic version of ls working (and
I'm assuming dir, but maybe not? :-) I will summarize here (so feel free
to keep sending suggestions/pointers). Thanks to everyone who has sent
them so far!

Cheers,

---

From: Emil Isberg <[email-masked]>
Date: Fri, 31 Jan 1997 01:06:21 +0100 (MET)

> have ended up in the same place as [email-masked]).

Hmm .. http://www.mds.mdh.se/~cel95eig/
 or if you could download binary directly:
       http://www.mds.mdh.se/~cel95eig/ls-static
(why you should trust this binary? .. I'd say no .. don't trust any binary
that you haven't make'd!! But I'll give you this one anyway, 'cause I use
it myself .. :-)
If you can't download it from there .. mail me and I'll uuencode it and
send it by email to you ..

> patch posted here applied but get a bunch of ldd errors at link time. 

Hmmm .. could you mail me the output when you try to mak it?
(with what linker/compiler you use!)

> piecing all the info together from various sources :-)

Cool, I'll think I can mirror that one (when I finally get my page back up
.. It took to much space, so I removed it .. ahh and free'd <10 % ..
*sigh*)

---

From: Dirk Jahnke <[email-masked]>
Date: Fri, 31 Jan 1997 09:57:28 +0100

Hi Subu,

> What are the differences between the academ version and the 2.4 version ?)

Try this one:

ftp://ftp.academ.com/pub/wu-ftpd/private/wu-ftpd-2.4.2-beta-12.tar.Z

-- 

Hasta luego, Dirk.

---                                                      <|
-----------------------------------------------------    /|
    Dirk Jahnke                                         / |\
TU Hamburg - Harburg http://www.tu-harburg.de/rzt/rzt/dj  | \
 - RECHENZENTRUM -   mailto:[email-masked]      /   |  \
 Denickestrasse 22                                  o/o   |   \
   21071 Hamburg     Tel. : +49-(0)40/7718-3364   __8_8___|____\
      GERMANY        Fax. : +49-(0)40/7718-2803   |            /
~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-
          X.400: C=de A=d400 P=tu-harburg S=jahnke