Subject: Re: malloc error

From: [email-masked]
Date: Thu, 8 Oct 1998 10:36:58 +0900

Greg,

I tried to apply your patch and got the following error :

***************************************************************************
**************
[Host]:>/software/wu-ftpd-2.4.2-beta-18-vr8/src> patch < ../VR8.5a

Processing...  Looks like a new-style context diff...
The text leading up to this was:
--------------------------
|diff -c src/ftpd.c.orig src/ftpd.c
|*** src/ftpd.c.orig    Mon Sep 28 12:57:31 1998
|--- src/ftpd.c Wed Oct  7 13:28:34 1998
--------------------------
Patching file ftpd.c using Plan A...
patch: 3016-037 Malformed patch at line 7: static char *buf;
***************************************************************************
**************

In addition, I encountered a few other peculiarities :

a.   After applying CHAPAN's suggested code replacement (b4 applying your
patch), there were no entries of my attempts to open, navigate and get
files
from the FTP Server. Neither were there any debugging breakdown of commands
 in ftpd.debug and ftpd.info (from syslogd). Only entries in those 2 files
were the
FTP LOGIN and FTP session closed statements. Although I could "open" a file
 on the FTP server after applying CHAPAN's code, the file was blank. I
could
also "get" a file from the FTP server but the file would be 0 bytes in
size. Putting files into the FTP server worked ok though.

**************************FTPD.INFO******************************
Oct  8 10:19:58 dwh_db ftpd[18940]: FTP LOGIN FROM misdba [192.
168.160.133], root
Oct  8 10:23:57 dwh_db ftpd[18940]: FTP session closed
**********************************************************************

**************************FTPD.DEBUG******************************
Oct  8 10:19:58 dwh_db ftpd[18940]: FTP LOGIN FROM misdba [192.
168.160.133], root
Oct  8 10:23:57 dwh_db ftpd[18940]: FTP session closed
**************************************************************************

**************************XFERLOG******************************

********************************************************************

b.   Upon entering my FTP server, I could see the directory structure.
After changing to a sub-directory, I would not be able to see the
directories in the
sub-directory that I had navigated to. If I were to put a file into that
sub-directory though, the directory structure in that sub-directory would
appear as if it were refreshed
or something like that.

I'm running AIX 4.3.1 testing your wu-ftpd-2.4.2-beta-18-vr8 version
(without any of the patches VR8.1 - VR8.5)

Hope the above helps......

rgds and thks again

Victor

"lundberg+wuftpd"@vr.net on 08/10/98 01:39:29 AM

Please respond to "lundberg+wuftpd"@vr.net

To:   [email-masked]
cc:   Thian Leng Victor Tan/IT/SINGAPORE/BFI/BNP, [email-masked]
Subject:  Re: malloc error

On Wed, 7 Oct 1998, CHAPAN wrote:

> In the source code ftpd.c, find the label 'case TYPE_L:'.  The following
> line should be
>
>         if ((buf = (char *) malloc((u_int) blksize)) == NULL) {
>
> Replace it with:
>
>         if ((buf = (char *)  malloc(8192)) == NULL) {

[email-masked] reports errors on AIX with malloc.
[email-masked] confirms a problem in send_data().  This patch is
experimental against VR8 to attempt to correct the problem.  I'm working
on the supposition that the problem is data alignment; the 'blksize' is
off_t and malloc() wants a size_t.  I've added a conversion step which
should eliminate the problem.

While this patch is against VR8, it should work against all VR versions
and against the base, beta-18 version.  Hand editing will be required
against beta-18 and VR versions up to VR4 since the THROUGHPUT first
appeared in VR5.  After VR5, this patch should apply cleanly.

diff -c src/ftpd.c.orig src/ftpd.c
*** src/ftpd.c.orig	Mon Sep 28 12:57:31 1998
--- src/ftpd.c	Wed Oct  7 13:28:34 1998
***************
*** 3791,3796 ****
--- 3791,3797 ----
      static char *buf;
      int netfd,
        filefd;
+     size_t size_t_blksize;
  #ifdef THROUGHPUT
      int bps;
      double bpsmult;
***************
*** 3866,3872 ****
          if (bps != -1)
              blksize = bps;
  #endif
!         if ((buf = (char *) malloc((u_int) blksize)) == NULL) {
              transflag = 0;
              perror_reply(451, "Local resource failure: malloc");
              retrieve_is_data = 1;
--- 3867,3874 ----
          if (bps != -1)
              blksize = bps;
  #endif
!         size_t_blksize = blksize;
!         if ((buf = (char *) malloc(size_t_blksize)) == NULL) {
              transflag = 0;
              perror_reply(451, "Local resource failure: malloc");
              retrieve_is_data = 1;
***************
*** 3879,3885 ****
          if (bps != -1)
              t1 = time(NULL);
  #endif
!         while ((cnt = read(filefd, buf, (u_int) blksize)) > 0 &&
                 write(netfd, buf, cnt) == cnt){
     alarm((unsigned)timeout);
     byte_count += cnt;
--- 3881,3887 ----
          if (bps != -1)
              t1 = time(NULL);
  #endif
!         while ((cnt = read(filefd, buf, size_t_blksize)) > 0 &&
                 write(netfd, buf, cnt) == cnt){
     alarm((unsigned)timeout);
     byte_count += cnt;

--

Gregory A Lundberg	 Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 8 Oct 1998 03:31:46 -0400 (EDT)

> The text leading up to this was:

Probably it's a bad copy of the patch.  My fault for sending it in the
email rather than an attachment.  Try getting it from my ftp site.  You
seem to know where to look; it's VR8.11 .. take it, don't touch the other
patches unless you really like playing with fire.

> a.  After applying CHAPAN's suggested code replacement (b4 applying
> your patch), there were no entries of my attempts to open, navigate
> and get files from the FTP Server. Neither were there any debugging
> breakdown of commands in ftpd.debug and ftpd.info (from syslogd). Only
> entries in those 2 files were the FTP LOGIN and FTP session closed
> statements. Although I could "open" a file on the FTP server after
> applying CHAPAN's code, the file was blank. I could also "get" a file
> from the FTP server but the file would be 0 bytes in size. Putting
> files into the FTP server worked ok though.

CHAPAN's patch was to set the malloc() site to a constant 8K bytes without
changing the size of the read() .. very dangerous.  If the read() was for
over 8K this would guarentee a buffer overrun.  One possible length for
the read() is BUFSIZ, set in the C runtime (stdio.h on Linux sets it to 1K
bytes).  Another is 1, or 2, times the natural block size for the file
system (as determined stat() or lstat() function) which could be quite
large.

> directories in the sub-directory that I had navigated to. If I were to
> put a file into that sub-directory though, the directory structure in
> that sub-directory would appear as if it were refreshed or something
> like that.

Yep, sounds like a buffer overrun.

> (without any of the patches VR8.1 - VR8.5)

I should hope you're not using any other VR8.x patch.  Those patches are
my working notes for VR9 and should be considered HIGHLY experimental;
like we're doing with this one.  Just so you get the idea how dangerous
they are, I'll tell you that if you were to apply all of them, the
"upload" clause would probably begin denying upload permissions to
everyone (which caused me to turn off part of one of the patches on my
local server).

--