scality/Droplet — Issue #89: Stack smashing detected when signing an S3 HEAD request
Author: cvedel
Created: 2011-10-11 13:03:50+00:00
State: open

The droplet library is hosted in a C++ multi threaded server.
The stack smashing mechanism in gcc detects a problem in dpl_hmac_sha1.
The stack trace from the core dump is the following:

`Program terminated with signal 11, Segmentation fault.
#0 0x00007f3aa92e4ac8 in ?? () from /lib/x86_64-linux-gnu/libgcc_s.so.1
(gdb) where
#0 0x00007f3aa92e4ac8 in ?? () from /lib/x86_64-linux-gnu/libgcc_s.so.1
#1 0x00007f3aa92e5aa9 in _Unwind_Backtrace ()
from /lib/x86_64-linux-gnu/libgcc_s.so.1
#2 0x00007f3aa9040330 in backtrace () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007f3aa8faed8c in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x00007f3aa90401d7 in __fortify_fail ()
from /lib/x86_64-linux-gnu/libc.so.6
#5 0x00007f3aa90401a0 in __stack_chk_fail ()
from /lib/x86_64-linux-gnu/libc.so.6
#6 0x00007f3aa6b5894d in dpl_hmac_sha1 (key_buf=0x2bd77a8 "scality",
key_len=7,
data_buf=0x7f3aa5df0530 "HEAD\n\n\nTue, 11 Oct 2011 12:16:37 GMT\n/xxx/home%2Fadobe%2Ffms%2Fwebroot%2Fvod%2Fsample1%5F150kbps%2Ef4v", data_len=102,
digest_buf=0x7f3aa5df0130 "8\242\025\224i\037R") at src/utils.c:467
#7 0x00007f3aa6b6399c in add_authorization_to_headers (req=0x0, headers=0x0)
at s3/reqbuilder.c:386
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb)`
The code appears to have computed the right digest value:
`(gdb) p /x digest_buf[0]@20`
`$6 = {0x38, 0xa2, 0x15, 0x94, 0x69, 0x1f, 0x52, 0x0, 0x78, 0x7b, 0x90, 0x4c,
0xf, 0x2c, 0x4f, 0x2b, 0xa5, 0x5c, 0xca, 0x31}`

Compared to:
`openssl dgst -sha1 -hmac scality test`
`HMAC-SHA1(test)= 38a21594691f5200787b904c0f2c4f2ba55cca31`

where test is a file containing the string to sign (data_buf) and.
scality is the password