[SOLVED] Buffer overflow after client disconnect on customer's server

Caelum

Caelum

Donator
Posts
24
Likes
53
Had this happen on a customer's server (the same I posted that other thread for), who urged me to post about it so you guys could fix it. Since I just registered and posted that other bug anyway, figured I might as well.

Code: 
Going from CS_PRIMED to CS_ACTIVE for ^4Ni^7co'Kau^7^9ri
ClientBegin: 9
^4DEBUG: er(43): move( <1023.000000 3964.000000 936.000000>, 10.000000 ); [11235                                                                                                                                                             843]
^4DEBUG: el(44): move( <709.000000 3964.000000 936.000000>, 10.000000 ); [112358                                                                                                                                                             43]
^4DEBUG: forcefields1(272): wait( 10 ); [11235843]
^4DEBUG: 5b(184): rotate( <0.000000,-315.000000,0.000000>, 1500); [11235876]
^4DEBUG: 5a(193): rotate( <0.000000,315.000000,0.000000>, 1500); [11235876]
^4DEBUG: forcefields1(272): wait( 500 ); [11235876]
^4DEBUG: fr(41): move( <1023.000000 3680.000000 936.000000>, 10.000000 ); [11236                                                                                                                                                             404]
^4DEBUG: fl(42): move( <709.000000 3680.000000 936.000000>, 10.000000 ); [112364                                                                                                                                                             04]
^4DEBUG: forcefields1(272): wait( 10 ); [11236404]
^4DEBUG: 6b(40): rotate( <0.000000,-315.000000,0.000000>, 1500); [11236437]
^4DEBUG: 6a(183): rotate( <0.000000,315.000000,0.000000>, 1500); [11236437]
^4DEBUG: forcefields1(272): wait( 5000 ); [11236437]
clientCommand: ^7*^0TJA^0^7* ^3^4^7Master ^0Al : 72 : disconnect
broadcast: print "^7*^0TJA^0^7* ^3^4^7Master ^0Al^7 @@@DISCONNECTED\n"
]  *** buffer overflow detected ***: /home/shared/jka terminated
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(+0x68e4e)[0xf7501e4e]
/lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x6b)[0xf759485b]
/lib/i386-linux-gnu/libc.so.6(+0xfa6ea)[0xf75936ea]
/lib/i386-linux-gnu/libc.so.6(__strcpy_chk+0x37)[0xf7592bc7]
/home/jka.46.105.85.236/MBII/jampgamei386.so(ClientDisconnect+0x86b)[0xeada73cb]
/home/jka.46.105.85.236/MBII/jampgamei386.so(vmMain+0x464)[0xeade7c34]
/home/shared/jka[0x808a9f5]
/home/shared/jka[0x80be75c]
/home/shared/jka[0x80ad619]
/home/shared/jka[0x80adce7]
/home/shared/jka[0x80afbcb]
/home/shared/jka[0x80afe2b]
/home/shared/jka[0x8061689]
/home/shared/jka[0x80618a5]
/home/shared/jka[0x804b7ca]
/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3)[0xf74b2a83]
/home/shared/jka[0x804b7ed]
======= Memory map: ========
08048000-08174000 r-xp 00000000 00:14 342657                             /home/s                                                                                                                                                             hared/jka/openjkded.i386
08174000-08178000 rw-p 0012c000 00:14 342657                             /home/s                                                                                                                                                             hared/jka/openjkded.i386
08178000-0847b000 rw-p 00000000 00:00 0
0850a000-094e9000 rw-p 00000000 00:00 0                                  [heap]
ead05000-eaef6000 r-xp 00000000 00:14 2358574                            /home/j                                                                                                                                                             ka.46.105.85.236/MBII/jampgamei386.so
eaef6000-eaef7000 ---p 001f1000 00:14 2358574                            /home/j                                                                                                                                                             ka.46.105.85.236/MBII/jampgamei386.so
eaef7000-eaef8000 r--p 001f1000 00:14 2358574                            /home/j                                                                                                                                                             ka.46.105.85.236/MBII/jampgamei386.so
eaef8000-eaf1a000 rw-p 001f2000 00:14 2358574                            /home/j                                                                                                                                                             ka.46.105.85.236/MBII/jampgamei386.so
eaf1a000-ecbde000 rw-p 00000000 00:00 0
ed6b4000-f7268000 rw-p 00000000 00:00 0
f7268000-f7273000 r-xp 00000000 00:14 343219                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_files-2.19.so
f7273000-f7274000 r--p 0000a000 00:14 343219                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_files-2.19.so
f7274000-f7275000 rw-p 0000b000 00:14 343219                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_files-2.19.so
f7275000-f727f000 r-xp 00000000 00:14 343205                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_nis-2.19.so
f727f000-f7280000 r--p 00009000 00:14 343205                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_nis-2.19.so
f7280000-f7281000 rw-p 0000a000 00:14 343205                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_nis-2.19.so
f7281000-f7296000 r-xp 00000000 00:14 343206                             /lib/i3                                                                                                                                                             86-linux-gnu/libnsl-2.19.so
f7296000-f7297000 r--p 00015000 00:14 343206                             /lib/i3                                                                                                                                                             86-linux-gnu/libnsl-2.19.so
f7297000-f7298000 rw-p 00016000 00:14 343206                             /lib/i3                                                                                                                                                             86-linux-gnu/libnsl-2.19.so
f7298000-f729a000 rw-p 00000000 00:00 0
f729a000-f72a1000 r-xp 00000000 00:14 343211                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_compat-2.19.so
f72a1000-f72a2000 r--p 00006000 00:14 343211                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_compat-2.19.so
f72a2000-f72a3000 rw-p 00007000 00:14 343211                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_compat-2.19.so
f72ac000-f72ad000 rw-p 00000000 00:00 0
f72b1000-f72c4000 r-xp 00000000 00:14 343217                             /lib/i3                                                                                                                                                             86-linux-gnu/libresolv-2.19.so
f72c4000-f72c5000 ---p 00013000 00:14 343217                             /lib/i3                                                                                                                                                             86-linux-gnu/libresolv-2.19.so
f72c5000-f72c6000 r--p 00013000 00:14 343217                             /lib/i3                                                                                                                                                             86-linux-gnu/libresolv-2.19.so
f72c6000-f72c7000 rw-p 00014000 00:14 343217                             /lib/i3                                                                                                                                                             86-linux-gnu/libresolv-2.19.so
f72c7000-f72c9000 rw-p 00000000 00:00 0
f72c9000-f72ce000 r-xp 00000000 00:14 343213                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_dns-2.19.so
f72ce000-f72cf000 r--p 00004000 00:14 343213                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_dns-2.19.so
f72cf000-f72d0000 rw-p 00005000 00:14 343213                             /lib/i3                                                                                                                                                             86-linux-gnu/libnss_dns-2.19.so
f72d8000-f7499000 rw-p 00000000 00:00 0
f7499000-f7641000 r-xp 00000000 00:14 343202                             /lib/i3                                                                                                                                                             86-linux-gnu/libc-2.19.so
f7641000-f7643000 r--p 001a8000 00:14 343202                             /lib/i3                                                                                                                                                             86-linux-gnu/libc-2.19.so
f7643000-f7644000 rw-p 001aa000 00:14 343202                             /lib/i3                                                                                                                                                             86-linux-gnu/libc-2.19.so
f7644000-f7647000 rw-p 00000000 00:00 0
f7647000-f7663000 r-xp 00000000 00:14 2033766                            /lib/i3                                                                                                                                                             86-linux-gnu/libgcc_s.so.1
f7663000-f7664000 rw-p 0001b000 00:14 2033766                            /lib/i3                                                                                                                                                             86-linux-gnu/libgcc_s.so.1
f7664000-f76a8000 r-xp 00000000 00:14 343210                             /lib/i3                                                                                                                                                             86-linux-gnu/libm-2.19.so
f76a8000-f76a9000 r--p 00043000 00:14 343210                             /lib/i3                                                                                                                                                             86-linux-gnu/libm-2.19.so
f76a9000-f76aa000 rw-p 00044000 00:14 343210                             /lib/i3                                                                                                                                                             86-linux-gnu/libm-2.19.so
f76aa000-f7786000 r-xp 00000000 00:14 343297                             /usr/li                                                                                                                                                             b/i386-linux-gnu/libstdc++.so.6.0.19
f7786000-f778a000 r--p 000dc000 00:14 343297                             /usr/li                                                                                                                                                             b/i386-linux-gnu/libstdc++.so.6.0.19
f778a000-f778b000 rw-p 000e0000 00:14 343297                             /usr/li                                                                                                                                                             b/i386-linux-gnu/libstdc++.so.6.0.19
f778b000-f7793000 rw-p 00000000 00:00 0
f7793000-f7796000 r-xp 00000000 00:14 343203                             /lib/i3                                                                                                                                                             86-linux-gnu/libdl-2.19.so
f7796000-f7797000 r--p 00002000 00:14 343203                             /lib/i3                                                                                                                                                             86-linux-gnu/libdl-2.19.so
f7797000-f7798000 rw-p 00003000 00:14 343203                             /lib/i3                                                                                                                                                             86-linux-gnu/libdl-2.19.so
f7798000-f77b0000 r-xp 00000000 00:14 343634                             /usr/li                                                                                                                                                             b32/libz.so.1.2.8
f77b0000-f77b1000 r--p 00017000 00:14 343634                             /usr/li                                                                                                                                                             b32/libz.so.1.2.8
f77b1000-f77b2000 rw-p 00018000 00:14 343634                             /usr/li                                                                                                                                                             b32/libz.so.1.2.8
f77b2000-f77bd000 rw-p 00000000 00:00 0
f77bd000-f77bf000 r--p 00000000 00:00 0                                  [vvar]
f77bf000-f77c0000 r-xp 00000000 00:00 0                                  [vdso]
f77c0000-f77e0000 r-xp 00000000 00:14 343204                             /lib/i3                                                                                                                                                             86-linux-gnu/ld-2.19.so
f77e0000-f77e1000 r--p 0001f000 00:14 343204                             /lib/i3                                                                                                                                                             86-linux-gnu/ld-2.19.so
f77e1000-f77e2000 rw-p 00020000 00:14 343204                             /lib/i3                                                                                                                                                             86-linux-gnu/ld-2.19.so
ffd00000-ffd71000 rw-p 00000000 00:00 0                                  [staSen                                                                                                                                                             ding heartbeat to ravenmaster.cloudapp.net
Sending heartbeat to master.jkhub.org
Sending heartbeat to master.moviebattles.org
Sending heartbeat to master2.moviebattles.org
Sending heartbeat to ravenmaster.cloudapp.net
Sending heartbeat to master.jkhub.org
Sending heartbeat to master.moviebattles.org
Sending heartbeat to master2.moviebattles.org
^2INFO: 11237493 Script scripts/free_all_vars executed by noclass (null)
^4DEBUG: (null)(389): free( "balcside" ); [11237493]
^4DEBUG: (null)(389): free( "baybomb_status" ); [11237493]
^4DEBUG: (null)(389): free( "blue" ); [11237493]
^4DEBUG: (null)(389): free( "blueblock" ); [11237493]
^4DEBUG: (null)(389): free( "bomb1" ); [11237493]
^4DEBUG: (null)(389): free( "bomb2" ); [11237493]
^4DEBUG: (null)(389): free( "bomb3" ); [11237493]
^4DEBUG: (null)(389): free( "bomb4" ); [11237493]
^4DEBUG: (null)(389): free( "bombcount" ); [11237493]
^4DEBUG: (null)(389): free( "bomb_status" ); [11237493]
^4DEBUG: (null)(389): free( "bridge_lock" ); [11237493]
^4DEBUG: (null)(389): free( "bridge_status" ); [11237493]
^4DEBUG: (null)(389): free( "bridge_use" ); [11237493]
^4DEBUG: (null)(389): free( "com_ele_1_loc" ); [11237493]
^4DEBUG: (null)(389): free( "com_ele_2_loc" ); [11237493]
^4DEBUG: (null)(389): free( "current_floor" ); [11237493]
^4DEBUG: (null)(389): free( "current_floor_2" ); [11237493]
^4DEBUG: (null)(389): free( "current_floor_3" ); [11237493]
^4DEBUG: (null)(389): free( "current_floor_4" ); [11237493]
^4DEBUG: (null)(389): free( "ele1_status" ); [11237493]
^4DEBUG: (null)(389): free( "ele2_status" ); [11237493]
^4DEBUG: (null)(389): free( "ele3_status" ); [11237493]
^4DEBUG: (null)(389): free( "ele_1_oc" ); [11237493]
^4DEBUG: (null)(389): free( "ele_2_oc" ); [11237493]
^4DEBUG: (null)(389): free( "ghostbody" ); [11237493]
^4DEBUG: (null)(389): free( "gravanomaly" ); [11237493]
^4DEBUG: (null)(389): free( "ispawn" ); [11237493]
^4DEBUG: (null)(389): free( "kh_location" ); [11237493]
^4DEBUG: (null)(389): free( "kh_location5" ); [11237493]
^4DEBUG: (null)(389): free( "kh_target" ); [11237493]
^4DEBUG: (null)(389): free( "kh_target2" ); [11237493]
^4DEBUG: (null)(389): free( "lift1" ); [11237493]
^4DEBUG: (null)(389): free( "lift2" ); [11237493]
^4DEBUG: (null)(389): free( "lift_active" ); [11237493]
^4DEBUG: (null)(389): free( "ma_1_loc" ); [11237493]
^4DEBUG: (null)(389): free( "ma_2_loc" ); [11237493]
^4DEBUG: (null)(389): free( "mid_ele_loc" ); [11237493]
^4DEBUG: (null)(389): free( "mood" ); [11237493]
^4DEBUG: (null)(389): free( "red" ); [11237493]
^4DEBUG: (null)(389): free( "redblock" ); [11237493]
^4DEBUG: (null)(389): free( "rspawn" ); [11237493]
^4DEBUG: (null)(389): free( "sides" ); [11237493]
^4DEBUG: (null)(389): free( "stopmoving" ); [11237493]
^4DEBUG: (null)(389): free( "target_floor" ); [11237493]
^4DEBUG: (null)(389): free( "target_floor_2" ); [11237493]
^4DEBUG: (null)(389): free( "target_floor_3" ); [11237493]
^4DEBUG: (null)(389): free( "target_floor_4" ); [11237493]
^4DEBUG: (null)(389): free( "tdoor" ); [11237493]
^4DEBUG: (null)(389): free( "throne" ); [11237493]
^4DEBUG: (null)(389): free( "thronespawn" ); [11237493]
^4DEBUG: (null)(389): free( "topele_loc" ); [11237493]
^4DEBUG: (null)(389): free( "var_counter" ); [11237493]
^4DEBUG: (null)(389): free( "var_defuse" ); [11237493]
^4DEBUG: (null)(389): free( "vent_ele_1_loc" ); [11237493]
^4DEBUG: (null)(389): free( "vent_ele_1_use" ); [11237493]
^4DEBUG: (null)(389): free( "vent_ele_2_loc" ); [11237493]
^4DEBUG: (null)(389): free( "vent_ele_2_use" ); [11237493]
^4DEBUG: (null)(389): free( "vent_ele_3_loc" ); [11237493]
^4DEBUG: (null)(389): free( "vent_ele_3_use" ); [11237493]
^4DEBUG: (null)(389): free( "vent_s_act" ); [11237493]
^4DEBUG: (null)(389): free( "windowa" ); [11237493]
^4DEBUG: (null)(389): free( "windowb" ); [11237493]
^4DEBUG: (null)(389): free( "winner" ); [11237493]
ShutdownGame:
------------------------------------------------------------
Automatically freeing 1213 blocks making up 20426699 bytes

For reference, when it refers to /home/shared/jka, that's where the OpenJK binaries live. Running Ubuntu 14.04, latest OpenJK build.
 
ent

ent

Movie Battles II Team
Posts
848
Likes
390
There supposes to be our crashlog with name format crash_log_[date].log in GameData or whereever the game is, unless bad ojk reregistered it. :(
Try to find it.
 
Last edited:
Spaghetti

Spaghetti

Floating in the void
R2D2
Movie Battles II Team Retired
Posts
1,637
Likes
1,633
This is something we've been trying to pinpoint for a while (since at least V1). It does not occur anywhere except full / highly populated servers, and only intermittently, so difficult to reproduce in a controlled manner.
 
You must log in or register to reply here.
Top