Bug 441695

Summary: ftp client segfaults - aborts with memory issue
Product: Red Hat Enterprise Linux 5 Reporter: Kevin B. Hendricks <khendricks>
Component: krb5Assignee: Nalin Dahyabhai <nalin>
Status: CLOSED DUPLICATE QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: low    
Version: 5.1CC: jplans
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-04-09 19:13:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
text log of gdb session none

Description Kevin B. Hendricks 2008-04-09 15:04:59 UTC
Description of problem:

The ftp client on my Redhat Enterprise 5 machines segfaults/aborts when transferring multiple files.

Linux localhost.localdomain 2.6.18-53.1.13.el5xen #1 SMP Mon Feb 11 13:41:50 EST 2008 x86_64 
x86_64 x86_64 GNU/Linux

Version-Release number of selected component (if applicable):

The machine has been yum updated to today.

How reproducible:

This is repeatable given the ftp site I am trying to download from.  I therefore ran ftp in gdb and saved 
what info I could from the crash.  Unfortunately, it appears the executable had been stripped of 
debugging symbols.

See the attachment for the backtrace and other info.  I don't run any ftpd servers locally so I can not set 
up a machine for you to use to replicate this.

Using another ftp client (such as ncftp) works like a charm with this site.  Also ftp clients on my Mac 
OSX system works just fine with this site.

Steps to Reproduce:
1. (see above)
2.
3.
  
Actual results:
glibc aborts

Expected results:
files are transfered

Additional info: Here is the main backtrace

*** glibc detected *** /usr/kerberos/bin/ftp: free(): invalid next size (fast): 0x0000555566613170 ***
(no debugging symbols found)
======= Backtrace: =========
/lib64/libc.so.6[0x2aaaac6b24f4]
/lib64/libc.so.6(cfree+0x8c)[0x2aaaac6b5b1c]
/usr/lib64/libkrb5support.so.0[0x2aaaab9d5d47]
/usr/lib64/libkrb5support.so.0(krb5int_labeled_fopen+0x34)[0x2aaaab9d6074]
/usr/kerberos/bin/ftp[0x555555563a88]
/usr/kerberos/bin/ftp[0x55555555ec62]
/usr/kerberos/bin/ftp(main+0x453)[0x555555566ef3]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x2aaaac6608a4]
/usr/kerberos/bin/ftp[0x55555555a0a9]

(gdb) where
#0  0x00002aaaac673055 in raise () from /lib64/libc.so.6
#1  0x00002aaaac674af0 in abort () from /lib64/libc.so.6
#2  0x00002aaaac6ab24b in __libc_message () from /lib64/libc.so.6
#3  0x00002aaaac6b24f4 in _int_free () from /lib64/libc.so.6
#4  0x00002aaaac6b5b1c in free () from /lib64/libc.so.6
#5  0x00002aaaab9d5d47 in krb5int_mutex_free () from /usr/lib64/libkrb5support.so.0
#6  0x00002aaaab9d6074 in krb5int_labeled_fopen () from /usr/lib64/libkrb5support.so.0
#7  0x0000555555563a88 in ?? () from /usr/kerberos/bin/ftp
#8  0x000055555555ec62 in ?? () from /usr/kerberos/bin/ftp
#9  0x0000555555566ef3 in main () from /usr/kerberos/bin/ftp

Please see the attachment for the log of the entire gdb session.

I would be happy to test a new version of ftp on this same ftp site if a test case is available.

Comment 1 Kevin B. Hendricks 2008-04-09 15:04:59 UTC
Created attachment 301823 [details]
text log of gdb session

Comment 2 Martin Nagy 2008-04-09 15:36:29 UTC
How did you manage to use kerberos with ftp for authentication?

Comment 3 Kevin B. Hendricks 2008-04-09 15:52:36 UTC
Hi,

I am not sure I understand the question?  I did not intentionally use "kerberos". 
All I did was ssh into my EL5 machine and then issue the ftp ftp.spcompustat.com command and tried 
to retrieve the files.

It then crashed so I tried again and it crashed again.

So I tried while running under gdb and produced the log file I put as an attachment.

I have a pretty vanilla install of EL5 (we are just in the process of developing a website on that machine 
to house the data I was trying to download to that machine).   Everything on that machine was install via 
yum except for the ncftp package I just added to see if it segfaulted as well.

Would you like me to query the rpm database on the machine for any specific packages?

Just let me know what additional info you need.

Kevin






Comment 4 Kevin B. Hendricks 2008-04-09 15:59:30 UTC
[kbhend@localhost ~]$ rpm -qa | grep krb5
pam_krb5-2.2.14-1
krb5-devel-1.6.1-17.el5_1.1
krb5-libs-1.6.1-17.el5_1.1
krb5-auth-dialog-0.7-1
krb5-workstation-1.6.1-17.el5_1.1
pam_krb5-2.2.14-1
krb5-devel-1.6.1-17.el5_1.1
krb5-libs-1.6.1-17.el5_1.1

and the krb5-workstation package includes

[kbhend@localhost ~]$ rpm -ql krb5-workstation-1.6.1-17.el5_1.1 
/etc/pam.d/ekshell
/etc/pam.d/gssftp
/etc/pam.d/kshell
/etc/profile.d/krb5-workstation.csh
/etc/profile.d/krb5-workstation.sh
/etc/rc.d/init.d/krb524
/etc/sysconfig/krb524
/etc/xinetd.d/eklogin
/etc/xinetd.d/ekrb5-telnet
/etc/xinetd.d/gssftp
/etc/xinetd.d/klogin
/etc/xinetd.d/krb5-telnet
/etc/xinetd.d/kshell
/usr/kerberos
/usr/kerberos/bin
/usr/kerberos/bin/ftp
/usr/kerberos/bin/gss-client
/usr/kerberos/bin/kdestroy
/usr/kerberos/bin/kinit
/usr/kerberos/bin/klist
/usr/kerberos/bin/kpasswd
/usr/kerberos/bin/krb524init
/usr/kerberos/bin/krlogin
/usr/kerberos/bin/krsh
/usr/kerberos/bin/ksu
/usr/kerberos/bin/kvno
/usr/kerberos/bin/rcp
/usr/kerberos/bin/rlogin
/usr/kerberos/bin/rsh
/usr/kerberos/bin/sim_client
/usr/kerberos/bin/telnet
/usr/kerberos/bin/uuclient
/usr/kerberos/bin/v4rcp
/usr/kerberos/man
/usr/kerberos/man/man1
/usr/kerberos/man/man1/ftp.1.gz
/usr/kerberos/man/man1/kdestroy.1.gz
/usr/kerberos/man/man1/kinit.1.gz
/usr/kerberos/man/man1/klist.1.gz
/usr/kerberos/man/man1/kpasswd.1.gz
/usr/kerberos/man/man1/krb5-send-pr.1.gz
/usr/kerberos/man/man1/krb524init.1.gz
/usr/kerberos/man/man1/ksu.1.gz
/usr/kerberos/man/man1/kvno.1.gz
/usr/kerberos/man/man1/rcp.1.gz
/usr/kerberos/man/man1/rlogin.1.gz
/usr/kerberos/man/man1/rsh.1.gz
/usr/kerberos/man/man1/telnet.1.gz
/usr/kerberos/man/man1/v4rcp.1.gz
/usr/kerberos/man/man8
/usr/kerberos/man/man8/ftpd.8.gz
/usr/kerberos/man/man8/k5srvutil.8.gz
/usr/kerberos/man/man8/kadmin.8.gz
/usr/kerberos/man/man8/klogind.8.gz
/usr/kerberos/man/man8/krb524d.8.gz
/usr/kerberos/man/man8/kshd.8.gz
/usr/kerberos/man/man8/ktutil.8.gz
/usr/kerberos/man/man8/login.krb5.8.gz
/usr/kerberos/man/man8/telnetd.8.gz
/usr/kerberos/sbin
/usr/kerberos/sbin/ftpd
/usr/kerberos/sbin/gss-server
/usr/kerberos/sbin/k5srvutil
/usr/kerberos/sbin/kadmin
/usr/kerberos/sbin/klogind
/usr/kerberos/sbin/krb5-send-pr
/usr/kerberos/sbin/krb524d
/usr/kerberos/sbin/kshd
/usr/kerberos/sbin/ktutil
/usr/kerberos/sbin/login.krb5
/usr/kerberos/sbin/sim_server
/usr/kerberos/sbin/telnetd
/usr/kerberos/sbin/uuserver
/usr/share/doc/krb5-workstation-1.6.1
/usr/share/doc/krb5-workstation-1.6.1/convert-config-files
/usr/share/doc/krb5-workstation-1.6.1/kdestroy.html
/usr/share/doc/krb5-workstation-1.6.1/kinit.html
/usr/share/doc/krb5-workstation-1.6.1/klist.html
/usr/share/doc/krb5-workstation-1.6.1/kpasswd.html
/usr/share/doc/krb5-workstation-1.6.1/ksu.html
/usr/share/doc/krb5-workstation-1.6.1/services.append
/usr/share/doc/krb5-workstation-1.6.1/user-guide.ps.gz
/usr/share/info/krb5-user.info.gz

and 

[kbhend@localhost ~]$ which ftp
/usr/kerberos/bin/ftp

[kbhend@localhost ~]$ whereis ftp
ftp: /usr/bin/ftp /usr/share/man/man1/ftp.1.gz
[kbhend@localhost ~]$ 

So it appears that the krb5 el5 workstation package installed a version of ftp which appears in my path 
before the /usr/bin/ftp version.

So my bug report should be against the version of ftp installed by krb5-workstation package.

Sorry for not picking up on that earlier.

Kevin




Comment 5 Kevin B. Hendricks 2008-04-09 16:25:47 UTC
Do you want me to change the Component to krb5 instead of ftp?



Comment 6 Martin Nagy 2008-04-09 19:04:54 UTC
Yes, this binary belongs to kerberos. Changing component to krb5.

Comment 7 Nalin Dahyabhai 2008-04-09 19:13:59 UTC
Looks like a duplicate of bug #426085, which should be fixed by the current
beta.  Marking as a duplicate.

*** This bug has been marked as a duplicate of 426085 ***