[freetds] Segfault in tds_convert_key

Lowden, James K LowdenJK at bernstein.com
Wed Apr 30 13:31:11 EDT 2003


> From: Chris Spears [mailto:Chris.Spears at harrynorman.com]
> Sent: April 30, 2003 9:35 AM
> 
> Received packet @ 2003-04-30 09:25:50.783237
> 0000  ed 30 00 4e 54 4c 4d 53  53 50 00 02 00 00 00 00   
> |.0.NTLMS SP......|
> 0010  00 00 00 30 00 00 00 01  82 00 00 e4 1e 6b 84 74   
> |...0.... .....k.t|
> 0020  ce f4 ba 00 00 00 00 00  00 00 00 00 00 00 00 30   
> |........ .......0|
> 0030  00 00 00                                           |...|
> 
> 
> 2003-04-30 09:25:50.783303 looking for login token, got  ed(AUTH)
> TDS_AUTH_TOKEN PDU size 48
> TDS_AUTH_TOKEN nonce
> 0000  e4 1e 6b 84 74 ce f4 ba                            |..k.t...|
> 
> 2003-04-30 09:25:50.783388 Draining 8 bytes
> 2003-04-30 09:25:50.783421 tds_put_string converting 11 bytes of
> "DOMAINNAME"
> 2003-04-30 09:25:50.783453 tds_put_string wrote 22 bytes
> 2003-04-30 09:25:50.783474 tds_put_string converting 12 bytes of
> "Chris.Spears"
> 2003-04-30 09:25:50.783498 tds_put_string wrote 24 bytes
> 2003-04-30 09:25:50.783519 tds_put_string converting 14 bytes of
> "RADIUS-031-001"
> 2003-04-30 09:25:50.783543 tds_put_string wrote 28 bytes

This all looks reasonable, so far.  

> Died in tds_convert_key

I think this is a little misleading, right?  That message is printed as
you're leaving tds_convert_key().  Doesn't it really mean "done in
tds_convert_key"?  (I'm not reproaching you; just making sure I understand.)

> tds_convert_key(unsigned char *key_56, DES_KEY * ks)
> {
...
>         memset(&key, 0, sizeof(key));
> tdsdump_log(TDS_DBG_ERROR, "Died in tds_convert_key");
> }
                              ^^^^^^ not dead if printed

Do you get past tds_des_ecb_encrypt()?  

> Seems very odd to me that it dies in that spot.  TSQL connects
> to the mssql2k database no problem with the exact same code.  
> I attempted to use gdb to discover exactly where it dies but it 
> appears the memory is corrupted upon dead and gdb could not 
> read any of the frames.  

Could not read the frames?  Or could not read the symbols?  I've never been
able to read a core file without loading the symbols separately.  

Sorry, Chris.  Even with the information you've provided, I don't think I
can duplicate the problem (don't normally have access to a domain login
setup).  It might be related to my charset work.  Ibiblio has a snapshot
taken from before I began; you could try that.  Perhaps if you could convert
your module to an executable, you could run it under gdb to get a backtrace.
If you do find the error, I'd be happy to rectify it.  (Even though I think
the free radius folks made a strategic error using libtds, I suppose it can
be helpful to us in exposing libtds bugs).  

Regards, 

--jkl


The information contained in this transmission may contain privileged and
confidential information and is intended only for the use of the person(s)
named above.  If you are not the intended recipient, or an employee or agent
responsible for delivering this message to the intended recipient, any
review, dissemination, distribution or duplication of this communication is
strictly prohibited. If you are not the intended recipient, please contact
the sender immediately by reply e-mail and destroy all copies of the
original message. Please note that we do not accept account orders and/or
instructions by e-mail, and therefore will not be responsible for carrying
out such orders and/or instructions.




More information about the FreeTDS mailing list