Out of Bounds Write Attempt - Fatal
ArcNyxx opened this issue · comments
The assertion
Assert Failed: (size_t)len < (size_t)sizeof(b->hash)
aborts at src/discord-ratelimit.c:33:.
I believe this is due to DISCORD_ROUTE_LEN being defined as 64 and the
length of the string which is being given to the assertion is 71. The string
generated can be found in the stack trace:
#0 0x00007ffff7d9e34c in __pthread_kill_implementation () from /usr/lib/libc.so.6
#1 0x00007ffff7d514b8 in raise () from /usr/lib/libc.so.6
#2 0x00007ffff7d3b534 in abort () from /usr/lib/libc.so.6
#3 0x00005555555d4e93 in _discord_route_init (adapter=0x55555561a6b0,
route=0x55555580e5ec ":5:applications:%lu:guilds:896679108350722109:commands:%lu:permissions", b=0x555555819520)
at src/discord-ratelimit.c:33
#4 0x00005555555d73e2 in _discord_bucket_get_match (adapter=0x55555561a6b0,
route=0x55555580e5ec ":5:applications:%lu:guilds:896679108350722109:commands:%lu:permissions",
info=0x7fffffffd8c0) at src/discord-ratelimit.c:205
#5 0x00005555555d7c5f in discord_bucket_build (adapter=0x55555561a6b0, b=0x5555556194a0,
route=0x55555580e5ec ":5:applications:%lu:guilds:896679108350722109:commands:%lu:permissions",
info=0x7fffffffd8c0) at src/discord-ratelimit.c:371
#6 0x00005555555d3e28 in _discord_adapter_check_action (adapter=0x55555561a6b0, msg=0x55555561ff50)
at src/discord-adapter.c:810
#7 0x00005555555d4279 in discord_adapter_perform (adapter=0x55555561a6b0) at src/discord-adapter.c:882
#8 0x00005555555cfdbd in on_io_poller_curl (io=0x555555618ec0, mhandle=0x5555556188e0, user_data=0x55555561a6b0)
at src/discord-adapter.c:37
#9 0x00005555555cb38e in io_poller_perform (io=0x555555618ec0) at core/io_poller.c:111
#10 0x000055555555a016 in discord_run (client=0x55555561a600) at src/discord-client.c:353
#11 0x0000555555558888 in main (argc=1, argv=0x7fffffffe808) at wikid.c:78
Source code can be found here: https://github.com/arcnyxx/wikid
Using Concord with latest commit hash fe93008.
Hey, thanks for filing a report.
Does this issue also manifest with the update_deps branch?
No, it does not. It seems that when I updated I got some new warnings about missing function prototypes for the free function. Thanks for the suggestion and sorry for the use of your time.
Alright, glad you could get it fixed! We are in the process of replacing utHash with Antropez's chash, as utHash has some portability issues (particularly on System V C compilers). Nonetheless, the new replacement seems to be much more reliable than utHash.