Bug#801763: uninitialised variable create crash
fuxfwgc4a2i1gr
fuxfwgc4a2i1gr at gmail.com
Wed Oct 14 11:02:56 UTC 2015
Package: libfreeradius-client2
Version: 1.1.6-7
libfreeradius_client.so.2.0.0:00007FF222D1DB8C call near ptr unk_7FF222D1C6E0
libfreeradius_client.so.2.0.0:00007FF222D1DB91 test rax, rax
libfreeradius_client.so.2.0.0:00007FF222D1DB94 jz short loc_7FF222D1DBA0
libfreeradius_client.so.2.0.0:00007FF222D1DB96 cmp dword ptr [rax+2Ch], 6
libfreeradius_client.so.2.0.0:00007FF222D1DB9A jz loc_7FF222D1E2B3
libfreeradius_client.so.2.0.0:00007FF222D1DBA0
libfreeradius_client.so.2.0.0:00007FF222D1DBA0 loc_7FF222D1DBA0: ; CODE XREF: rc_send_server+64j
libfreeradius_client.so.2.0.0:00007FF222D1DBA0 mov rsi, [r14+18h] < ----------------------------- THIS CHECK COMPLETELY NOT HAVE ANY SENSE BECAUSE DATA ALWAYS RANDOM. Check description below
libfreeradius_client.so.2.0.0:00007FF222D1DBA4 test rsi, rsi <-------/
libfreeradius_client.so.2.0.0:00007FF222D1DBA7 jz loc_7FF222D1E228 <----/
libfreeradius_client.so.2.0.0:00007FF222D1DBAD lea rdx, [rsp+41B8h+var_4088]
libfreeradius_client.so.2.0.0:00007FF222D1DBB5 mov [rsp+41B8h+var_4198], rdx
libfreeradius_client.so.2.0.0:00007FF222D1DBBA mov rdi, [rsp+41B8h+var_4198]
libfreeradius_client.so.2.0.0:00007FF222D1DBBF mov edx, 30h
libfreeradius_client.so.2.0.0:00007FF222D1DBC4 call near ptr unk_7FF222D1C130
libfreeradius_client.so.2.0.0:00007FF222D1DBC9
libfreeradius_client.so.2.0.0:00007FF222D1DBC9 loc_7FF222D1DBC9: ; CODE XREF: rc_send_server+705j
libfreeradius_client.so.2.0.0:00007FF222D1DBC9 mov rcx, [rsp+41B8h+var_4198]
libfreeradius_client.so.2.0.0:00007FF222D1DBCE mov rsi, [rsp+41B8h+var_4190]
libfreeradius_client.so.2.0.0:00007FF222D1DBD3 lea rdx, [rsp+41B8h+var_4174]
libfreeradius_client.so.2.0.0:00007FF222D1DBD8 mov rdi, [rsp+41B8h+var_4188]
libfreeradius_client.so.2.0.0:00007FF222D1DBDD call near ptr unk_7FF222D1C240
libfreeradius_client.so.2.0.0:00007FF222D1DBE2 test eax, eax
When rc_send_server executed from rc_aaa then
if(data->secret != NULL) will always give Strange and unexpected results because data->secret not initialized in rc_aaa.
If not to do initialisation then i think your application constantly will crash in moment of usage rc_auth.
I suggest to initialize in rc_aaa ( buildreq.c )
data.secret = NULL; after line data.receive_pairs = NULL;
More information about the Pkg-voip-maintainers
mailing list