[0.13.20 only] parallel RCON crashes with buffer-overflow

Bugs that we were not able to reproduce, and/or are waiting for more detailed info.
Post Reply
User avatar
riking
Inserter
Inserter
Posts: 42
Joined: Thu May 05, 2016 5:35 pm
Contact:

[0.13.20 only] parallel RCON crashes with buffer-overflow

Post by riking »

Continuing from the previous topic, the RCON connection now works but the server crashes when I try to run a simple /c command in parallel with another connection.

Action:

Make two parallel RCON connections and send the same wrong password on both.

Expected:

Both connections receive a bad-auth packet.

Actual:

Code: Select all

  10.253 Info RemoteCommandProcessor.cpp:94: Starting RCON interface at port 33197
  10.373 Info MultiplayerManager.cpp:1531: Received peer info for peer(0) username(<server>).
  10.373 Info MultiplayerManager.cpp:1147: networkTick(6) mapTick(1300805) received stateChanged peerID(0) oldState(Ready) newState(CreatingGame)
  10.373 Info MultiplayerManager.cpp:1147: networkTick(6) mapTick(1300805) received stateChanged peerID(0) oldState(CreatingGame) newState(InGame)
  50.296 Info RemoteCommandProcessor.cpp:201: New RCON connection from 127.0.0.1:40845
  50.299 Info RemoteCommandProcessor.cpp:201: New RCON connection from 127.0.0.1:40844
  52.550 Info RemoteCommandProcessor.cpp:201: New RCON connection from 127.0.0.1:40853
  52.551 Info RemoteCommandProcessor.cpp:201: New RCON connection from 127.0.0.1:40852
> *** buffer overflow detected ***: bin/x64/factorio terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x77725)[0x7f143f1a4725]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7f143f24589c]
/lib/x86_64-linux-gnu/libc.so.6(+0x1168a0)[0x7f143f2438a0]
/lib/x86_64-linux-gnu/libc.so.6(+0x1187e7)[0x7f143f2457e7]
bin/x64/factorio[0x4b7615]
bin/x64/factorio[0x525d37]
bin/x64/factorio[0x6e5d2d]
bin/x64/factorio[0x108c353]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76fa)[0x7f143fe286fa]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7f143f233b5d]
======= Memory map: ========

 (cut - https://gist.github.com/riking/55de78f4d8a7a4b5271ae048b4b1de95 - )

  55.879 Warning Logger.cpp:360: Symbols.size() == 18, usedSize == 16
Factorio crashed. Generating symbolized stacktrace, please wait ...
  58.170 Warning Logger.cpp:360: Symbols.size() == 17, usedSize == 15
#0  0x5032cb in CrashHandler::writeStackTrace() at /tmp/factorio-c56SxD/src/Util/CrashHandler.cpp:105
#1  0x503544 in CrashHandler::SignalHandler(int) at /tmp/factorio-c56SxD/src/Util/CrashHandler.cpp:215
#2  0x7f143f1624a0 in ?? at ??:0
#3  0x7f143f162418 in ?? at ??:0
#4  0x7f143f16401a in ?? at ??:0
#5  0x7f143f1a472a in ?? at ??:0
#6  0x7f143f24589c in ?? at ??:0
#7  0x7f143f2438a0 in ?? at ??:0
#8  0x7f143f2457e7 in ?? at ??:0
#9  0x4b7615 in TCPSocket::wait() at /tmp/factorio-c56SxD/src/Net/TCPSocket.cpp:237
#10 0x525d37 in TCPSocket::recv(std::string&) at /tmp/factorio-c56SxD/src/Net/TCPSocket.cpp:134
#11 0x6e5d2d in updateClient at /tmp/factorio-c56SxD/src/RemoteCommandProcessor.cpp:221
#12 0x108c353 in operator() at /tmp/factorio-c56SxD/src/RemoteCommandProcessor.cpp:208
#13 0x7f143fe286fa in run at /home/build/build_environment/boost_1_61_0/output_linux64/include/boost/thread/detail/thread.hpp:116
#14 0x7f143f233b5d in thread_proxy at thread.cpp:?
  58.170 Error CrashHandler.cpp:106: Map tick at moment of crash: 1300805
  58.170 Error Util.cpp:77: Unexpected error occurred. If you're running the latest version of the game you can help us solve the problem by posting the contents of the log file on the Factorio forums.
Please also include the save file(s), any mods you may be using, and any steps you know of to reproduce the crash.
> Factorio server exited
> exit status 1

Code: Select all

connecting to rcon: Bad auth, could not authenticate.
connecting to rcon: read tcp4 127.0.0.1:40868->127.0.0.1:33197: read: connection reset by peer
Theory:

This may be related to the client code attempting two simultaneous connections to the same Factorio process. (this is due to a different bug in my client where it detects the process twice)

EDIT: lol, the password sent is wrong. __X is sent instead of the actual password. So I guess this is a crash on simultaneous bad auth?

User avatar
riking
Inserter
Inserter
Posts: 42
Joined: Thu May 05, 2016 5:35 pm
Contact:

Re: [0.13.20 only] parallel RCON crashes with buffer-overflow

Post by riking »

You know what, this isn't really important at all. Go ahead and dump this in Minor Issues or Won't Fix.

Daid
Fast Inserter
Fast Inserter
Posts: 163
Joined: Sun Jul 03, 2016 7:42 am
Contact:

Re: [0.13.20 only] parallel RCON crashes with buffer-overflow

Post by Daid »

riking wrote:You know what, this isn't really important at all. Go ahead and dump this in Minor Issues or Won't Fix.
May I disagree? A buffer overflow can (in quite some situations) be exploited by a hacked to introduce remote code execution. Kinda depends where this overflow is happening if it can be exploited without the proper password.

Oxyd
Former Staff
Former Staff
Posts: 1428
Joined: Thu May 07, 2015 8:42 am
Contact:

Re: [0.13.20 only] parallel RCON crashes with buffer-overflow

Post by Oxyd »

This should be fixed in 0.14. Can you reproduce it in 0.14.13?

Post Reply

Return to “Pending”