Re: dillo displays corrupted data using gopher protocol

Hi Ben,

On Mon, May 25, 2026 at 04:25:24PM -0700, Ben Collver wrote:
>
>I tried setting a breakpoint at line 349, watching the variables, and
>stepping through the code with gdb's `n` command, but in that context
>the plugin no longer gives SIGSEGV.
>
>Any more suggestions?

I enabled Asan with -fsanitize=address in CFLAGS and LDFLAGS and I see 
what is going on:

> =================================================================
> ==136179==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7b0195ff3040 at pc 0x5627981706b2 bp 0x7ffe14825560 sp 0x7ffe14825550
> READ of size 1 at 0x7b0195ff3040 thread T0
>     #0 0x5627981706b1 in read_line /home/ram/dev/dillo/plugin/gopher/gopher.filter.dpi.c:332
>     #1 0x5627981709c5 in read_response /home/ram/dev/dillo/plugin/gopher/gopher.filter.dpi.c:355
>     #2 0x562798170d95 in render_dir /home/ram/dev/dillo/plugin/gopher/gopher.filter.dpi.c:384
>     #3 0x56279817192c in respond /home/ram/dev/dillo/plugin/gopher/gopher.filter.dpi.c:466
>     #4 0x562798171b25 in main /home/ram/dev/dillo/plugin/gopher/gopher.filter.dpi.c:490
>     #5 0x7f0198027740  (/usr/lib/libc.so.6+0x27740) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
>     #6 0x7f0198027878 in __libc_start_main (/usr/lib/libc.so.6+0x27878) (BuildId: 020d6f7c33b2413f4fe10814c4729dce1387f049)
>     #7 0x56279816e384 in _start (/home/ram/.dillo/dpi/gopher/gopher.filter.dpi+0x3384) (BuildId: 2539342afa9ad468aea77caeadba0586e529a0f0)
> 
> Address 0x7b0195ff3040 is located in stack of thread T0 at offset 4160 in frame
>     #0 0x562798170791 in read_response /home/ram/dev/dillo/plugin/gopher/gopher.filter.dpi.c:340
> 
>   This frame has 2 object(s):
>     [32, 40) 'len' (line 342)
>     [64, 4160) 'buf' (line 341) <== Memory access at offset 4160 overflows this variable
> HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
>       (longjmp and C++ exceptions *are* supported)
> SUMMARY: AddressSanitizer: stack-buffer-overflow /home/ram/dev/dillo/plugin/gopher/gopher.filter.dpi.c:332 in read_line
> Shadow bytes around the buggy address:
>   0x7b0195ff2d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x7b0195ff2e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x7b0195ff2e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x7b0195ff2f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x7b0195ff2f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> =>0x7b0195ff3000: 00 00 00 00 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3
>   0x7b0195ff3080: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
>   0x7b0195ff3100: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
>   0x7b0195ff3180: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
>   0x7b0195ff3200: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
>   0x7b0195ff3280: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
> Shadow byte legend (one shadow byte represents 8 application bytes):
>   Addressable:           00
>   Partially addressable: 01 02 03 04 05 06 07
>   Heap left redzone:       fa
>   Freed heap region:       fd
>   Stack left redzone:      f1
>   Stack mid redzone:       f2
>   Stack right redzone:     f3
>   Stack after return:      f5
>   Stack use after scope:   f8
>   Global redzone:          f9
>   Global init order:       f6
>   Poisoned by user:        f7
>   Container overflow:      fc
>   Array cookie:            ac
>   Intra object redzone:    bb
>   ASan internal:           fe
>   Left alloca redzone:     ca
>   Right alloca redzone:    cb
> ==136179==ABORTING

There is a missing case in which we are reading a character pass the 
buffer (when i == len). I pushed the fix to the git repo:

https://git.dillo-browser.org/plugins/gopher/commit/?id=d8055639af10041cec953d33a93cae390aec1050

Let me know if that fixes it for you.

Best,
Rodrigo.
_______________________________________________
Dillo-dev mailing list -- dillo-dev-lx9mn2B4QYRWk0Htik3J/[email protected]
To unsubscribe send an email to dillo-dev-leave-lx9mn2B4QYRWk0Htik3J/[email protected]