{"action":"closed","issue":{"url":"https://api.github.com/repos/dlenski/openconnect/issues/101","repository_url":"https://api.github.com/repos/dlenski/openconnect","labels_url":"https://api.github.com/repos/dlenski/openconnect/issues/101/labels{/name}","comments_url":"https://api.github.com/repos/dlenski/openconnect/issues/101/comments","events_url":"https://api.github.com/repos/dlenski/openconnect/issues/101/events","html_url":"https://github.com/dlenski/openconnect/issues/101","id":314843660,"number":101,"title":"segmentation fault upon reconnect failure","user":{"login":"lvml","id":9969397,"avatar_url":"https://avatars0.githubusercontent.com/u/9969397?v=4","gravatar_id":"","url":"https://api.github.com/users/lvml","html_url":"https://github.com/lvml","followers_url":"https://api.github.com/users/lvml/followers","following_url":"https://api.github.com/users/lvml/following{/other_user}","gists_url":"https://api.github.com/users/lvml/gists{/gist_id}","starred_url":"https://api.github.com/users/lvml/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lvml/subscriptions","organizations_url":"https://api.github.com/users/lvml/orgs","repos_url":"https://api.github.com/users/lvml/repos","events_url":"https://api.github.com/users/lvml/events{/privacy}","received_events_url":"https://api.github.com/users/lvml/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-04-16T22:43:03Z","updated_at":"2018-04-17T22:09:49Z","closed_at":"2018-04-17T22:09:49Z","author_association":"NONE","body":"Before describing the problem, let me briefly praise you for writing this much anticipated extension to openconnect! :-)\r\n\r\n# Problem description\r\n\r\n1. I ran openconnect-gp as follows: `openconnect --protocol=gp --os=win --dump -vvvv --certificate=MyClientCertAndKeyAndCA.pem --usergroup=gateway vpn.somecompany.com`\r\n\r\n2. I had to use a terribly unstable WiFi connection, which was breaking apart like every 5 minutes. I noticed that after some successful reconnects, openconnect would segfault during a failed reconnection attempt. Retried a number of times, then switched on debugging:\r\n\r\nThe relevant message emitted to the console at the time of the failed reconnection-attempt:\r\n```\r\nFailed to read from SSL socket: The TLS connection was non-properly terminated.\r\nError fetching HTTPS response\r\n(core dumped)\r\n```\r\n\r\nLine emitted to syslog:\r\n```\r\nApr 16 22:01:38 linux-testpc openconnect[18329]: *** Error in `/usr/local/sbin/openconnect': free(): invalid size: 0x00000000015d7810 *** \r\n```\r\n\r\ngdb backtrace from core-dump:\r\n```\r\n(gdb) bt\r\n#0  0x00007fcd2864d1f7 in raise () from /lib64/libc.so.6\r\n#1  0x00007fcd2864e8e8 in abort () from /lib64/libc.so.6\r\n#2  0x00007fcd2868cf47 in __libc_message () from /lib64/libc.so.6\r\n#3  0x00007fcd28694619 in _int_free () from /lib64/libc.so.6\r\n#4  0x00007fcd2abb512f in free_optlist (opt=opt@entry=0x114c9c0) at library.c:287\r\n#5  0x00007fcd2abcd850 in gpst_get_config (vpninfo=0x100f400) at gpst.c:645\r\n#6  gpst_setup (vpninfo=0x100f400) at gpst.c:921\r\n#7  0x00007fcd2abb04cf in ssl_reconnect (vpninfo=vpninfo@entry=0x100f400) at ssl.c:1013\r\n#8  0x00007fcd2abcdf68 in gpst_mainloop (vpninfo=0x100f400, timeout=0x7ffefbb8b14c) at gpst.c:1124\r\n#9  0x00007fcd2abb7bdd in openconnect_mainloop (vpninfo=vpninfo@entry=0x100f400, reconnect_timeout=reconnect_timeout@entry=300, reconnect_interval=reconnect_interval@entry=10) at mainloop.c:232\r\n#10 0x0000000000403717 in main (argc=8, argv=0x7ffefbb8b6f8) at main.c:1659\r\n```\r\n\r\nLine of code and surrounding lines where the \"free() of invalid size\" occurs:\r\n```\r\n#4  0x00007fcd2abb512f in free_optlist (opt=opt@entry=0x114c9c0) at library.c:287\r\n287                     free(opt->option);\r\n\r\n282     {\r\n283             struct oc_vpn_option *next;\r\n284\r\n285             for (; opt; opt = next) {\r\n286                     next = opt->next;\r\n287                     free(opt->option);\r\n288                     free(opt->value);\r\n289                     free(opt);\r\n290             }\r\n291     }\r\n```\r\n\r\nValue of \"opt\":\r\n```\r\n(gdb) p opt\r\n$1 = (struct oc_vpn_option *) 0x114c9c0\r\n(gdb) p *opt\r\n$2 = {option = 0x15d7810 \"p\\001\", value = 0x14a1900 \"\\020\\304I\\001\", next = 0x20}\r\n```\r\n\r\nMy suspicion is that somehow the \"gpst_get_config\" parser is not robust against partial data received in responses from connections that suddenly break down.\r\n\r\n\r\n# Operating system and openconnect-gp version\r\n\r\ngit-head compiled as of today\r\n\r\noperating system:\r\nCentOS 7, stable kernel linux-4.15.3\r\n\r\n# GlobalProtect VPN information\r\n\r\n(Not much I can write here due to company policies on data classification.)"}}
{"actor":{"display_login":"dlenski"}}