I have written a status bar utility in C for DWM to display the time, date, CPU temp, and battery level. I recently noticed the program had crashed and found that it had a coredump. I recompiled the utility to include debugging symbols to debug with gdb
and it crashed about 10 minutes after starting. While analyzing the coredump with coredumpctl debug
I found the following line in the backtrace.
0x0000716af522c799 in __GI___fortify_fail (msg=msg@entry=0x716af52ba153 "buffer overflow detected") at fortify_fail.c:24
I have been combing through the code but I dont understand what is causing the buffer overflow as it runs fine for extended periods of time and have not had another crash happen sense.
The line in the code causing the issue is:
strcat(status, battery_buff);
GitHub repository with the code.
Github issue I created.
System Info:
- OS: Arch Linux (6.10.5-arch1-1)
- Window Manager: DWM (6.4.r5-3)
- X11: libx11 (1.8.10-1)
- CC: GCC (14.2.1+r32+geccf707e5ce-1)
Full GDB backtrace (thread apply all backtrace full
)
Thread 1 (Thread 0x716af50ce2c0 (LWP 1963)):
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
tid = <optimized out>
ret = 0
pd = <optimized out>
old_mask = {__val = {23}}
ret = <optimized out>
#1 0x0000716af519d463 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:78
No locals.
#2 0x0000716af5144120 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret = <optimized out>
#3 0x0000716af512b4c3 in __GI_abort () at abort.c:79
save_stage = 1
act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, sa_mask = {__val = {6786648855210017280, 0, 140721397189936, 101591911342992, 101591911411072, 100, 32, 140721397190128, 124704192526143, 101591911343744, 101591911343751, 101591911343752, 0, 140720308486146, 124704193122162, 1088703904}}, sa_flags = 907723264, sa_restorer = 0xb}
#4 0x0000716af512c354 in __libc_message_impl (fmt=fmt@entry=0x716af52ba16c "*** %s ***: terminatedn") at ../sysdeps/posix/libc_fatal.c:132
ap = {{gp_offset = 16, fp_offset = 23653, overflow_arg_area = 0x7ffc40e44ec0, reg_save_area = 0x7ffc40e44e50}}
fd = 2
iov = {{iov_base = 0x716af52ba16c, iov_len = 4}, {iov_base = 0x716af52ba153, iov_len = 24}, {iov_base = 0x716af52ba172, iov_len = 17}, {iov_base = 0x3000000030, iov_len = 140721397190376}, {iov_base = 0x7ffc40e44e20, iov_len = 6786648855210017280}, {iov_base = 0x7ffc40e44e60, iov_len = 124704192628220}, {iov_base = 0x5c65b5c98010, iov_len = 528}}
iovcnt = <optimized out>
total = <optimized out>
cp = <optimized out>
#5 0x0000716af522c799 in __GI___fortify_fail (msg=msg@entry=0x716af52ba153 "buffer overflow detected") at fortify_fail.c:24
No locals.
#6 0x0000716af522c124 in __GI___chk_fail () at chk_fail.c:28
No locals.
#7 0x0000716af522db1a in __strcat_chk (dest=dest@entry=0x5c65b5c9a390 " 12:17:25 PM | 08/18/2024 | 100°C | 100% ", src=src@entry=0x5c65b5c9a680 "| 100% ", destlen=<optimized out>, destlen@entry=42) at strcat_chk.c:34
s1 = <optimized out>
s2 = <optimized out>
c = <optimized out>
#8 0x00005c658482c381 in strcat (__dest=0x5c65b5c9a390 " 12:17:25 PM | 08/18/2024 | 100°C | 100% ", __src=0x5c65b5c9a680 "| 100% ") at /usr/include/bits/string_fortified.h:140
No locals.
#9 main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dmenustatus/dmenustatus/src/dmenustatus.c:87
step = 1
status = 0x5c65b5c9a390 " 12:17:25 PM | 08/18/2024 | 100°C | 100% "
datetime_buff = 0x5c65b5c9a9a0 " 12:17:25 PM | 08/18/2024 "
cputemp_buff = 0x5c65b5c9a450 "| 100°C "
battery_buff = 0x5c65b5c9a680 "| 100% "
1