Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use submodules instead of hardcoded symlinks #3

Closed
martinpaljak opened this issue May 2, 2015 · 4 comments
Closed

Use submodules instead of hardcoded symlinks #3

martinpaljak opened this issue May 2, 2015 · 4 comments

Comments

@martinpaljak
Copy link
Contributor

I have "~/projects" that usually is a huge flat folder with various development projects and/or repositories. Right now CCID instructions suggest to clone "contrib" which is a generic name and a conflict. While it could be an easy workaround to have a separate subfolder for PC/SC+CCID, why not make PCSC a submodule for CCID so that a single git clone --recursive would work ?
@LudovicRousseau
Copy link
Owner

I don't think submodules will work for me.

The official repos (for me) are at ssh://git.debian.org/git/pcsclite/*.git but I also want to be able to use repos at github. So I can't use a specific reposority name for a submodules.

Maybe you can create a pcsclite/ directory and clone the different needed project inside?

@martinpaljak
Copy link
Contributor Author

The trick is "relative submodules": http://blog.tremily.us/posts/Relative_submodules/

@LudovicRousseau
Copy link
Owner

Nice. I will have a look.

LudovicRousseau added a commit that referenced this issue May 10, 2015
@LudovicRousseau
Use git submodules for PCSC and contrib
28a44ae 
PCSC is a relative submodule to ../PCSC.git

contrib_libPCSCv2part10 is a relative submodule to ../contrib.git
I had to rename the directory to avoid a name clash with an already
existing contrib/ directory.

Thanks to Martin Paljak for the idea
#3
@LudovicRousseau
Copy link
Owner

Fixed in 28a44ae

LudovicRousseau added a commit that referenced this issue Nov 13, 2015
@LudovicRousseau
CreateChannelByNameOrChannel(): call FreeChannel() in case of error
522ebb2 
If the creation of a channel fails then call FreeChannel() instead of
IFDHCloseChannel().
The ressources are unalocated but with no access at the lower layer.

Since the creation failed the channel is not correctly created and
only part of the reader stucture is initialised.

The problem was discovered with the folowing problem:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff6fe2700 (LWP 6120)]
0x00007ffff5dca8f2 in CmdPowerOff (reader_index=0) at commands.c:1076
1076		cmd[6] = (*ccid_descriptor->pbSeq)++;
(gdb) print ccid_descriptor
$1 = (_ccid_descriptor *) 0x7ffff5fe0468 <usbDevice+40>
(gdb) print ccid_descriptor->pbSeq
$2 = (unsigned char *) 0x0

The pbSeq pointer is NULL and can't be dereferenced.

(gdb) bt
 #0  0x00007ffff5dca8f2 in CmdPowerOff (reader_index=0) at commands.c:1076
 #1  0x00007ffff5dce556 in IFDHCloseChannel (Lun=0) at ifdhandler.c:269
 #2  0x00007ffff5dce773 in CreateChannelByNameOrChannel (Lun=0,
     lpcDevice=0x269 <error: Cannot access memory at address 0x269>, Channel=0)
     at ifdhandler.c:194
 #3  0x000000000040673a in IFDOpenIFD (rContext=rContext@entry=0x61e010)
     at ifdwrapper.c:136
 #4  0x0000000000408151 in RFInitializeReader (rContext=0x61e010)
     at readerfactory.c:1036
 #5  0x0000000000408a93 in RFAddReader (readerNameLong=<optimized out>,
     port=2097152, library=<optimized out>,
     device=0x7ffff6fe1d30 "usb:08e6/3437:libusb-1.0:1:2:0")
     at readerfactory.c:329
 #6  0x000000000040d9d4 in HPAddHotPluggable (dev=0x0,
     bus_device=0x61d660 <readerTracker+32> "", interface=0,
     driver=<optimized out>, driver=<optimized out>, desc=...)
     at hotplug_libusb.c:608
 #7  0x000000000040dd2a in HPRescanUsbBus () at hotplug_libusb.c:373
 #8  0x000000000040dfa1 in HPEstablishUSBNotifications (pipefd=0x7fffffffe440)
     at hotplug_libusb.c:429
 #9  0x00007ffff75a30a4 in start_thread (arg=0x7ffff6fe2700)
     at pthread_create.c:309
 #10 0x00007ffff72d804d in clone ()
     at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
@draganafcb draganafcb mentioned this issue Oct 5, 2018
Closed
LudovicRousseau added a commit that referenced this issue Aug 8, 2020
@LudovicRousseau
T0ProcACK: fix a potential problem
6c0bcf3 
" Apparently, the fuzzer found one more similar bug: T0ProcACK() can be
called with the |proc_len| parameter equal to -1, leading to
stack-buffer-overflow.

The stack trace is:

    #1 0x56eee7 in T0ProcACK /ssd/ccid/src/fuzzer/../commands.c:1988:3
    #2 0x56d1d1 in CmdXfrBlockCHAR_T0 /ssd/ccid/src/fuzzer/../commands.c:2253:20
    #3 0x5754cc in IFDHTransmitToICC /ssd/ccid/src/fuzzer/../ifdhandler.c:1403:17

and the T0ProcACK() call is made from this line:
https://salsa.debian.org/rousseau/CCID/-/blob/c122e4f38cc7d1ffdb1fc0cece49145930d4634a/src/commands.c#L2197

The negative |proc_len| is the result of this equation: |exp_len -
*rcv_len|, with exp_len=2, *rcv_len=3 in the found scenario. "

The problem has been found by an automatic buzzer, not by a real problem
in the field.

Thanks to Maksim Ivanov for the bug report
LudovicRousseau added a commit that referenced this issue Mar 7, 2021
@LudovicRousseau
Fix a possible buffer overflow in T0ProcACK
56ab8ab 
tmp_buf[] has a size of 512 bytes so the maximum length should be 0x200
(512) instead of 0x20000 (131072).

Thanks to coverity scan for the bug report.

CID 1473613 (#3 of 3): Out-of-bounds access (OVERRUN)16.
overrun-buffer-arg: Overrunning array tmp_buf of 512 bytes by passing it
to a function which accesses it at byte offset 131071 using argument
remain_len (which evaluates to 131072).
LudovicRousseau added a commit that referenced this issue Oct 23, 2023
@LudovicRousseau
Fix thread safe issue
72f2f23 
Declare LogLevel as _Atomic as it can be accessed from 2 different
threads.

==================
WARNING: ThreadSanitizer: data race (pid=35789)
  Write of size 4 at 0x7f123aafe310 by thread T3 (mutexes: write M0):
    #0 IFDHICCPresence CCID/src/ifdhandler.c:1986:12 (libccid.so+0xaa94) (BuildId: 34d145182e49b1532fafda06218243582b2f9366)
    #1 IFDStatusICC PCSC/src/ifdwrapper.c:349:7 (pcscd+0xd7725) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #2 EHStatusHandlerThread PCSC/src/eventhandler.c:332:8 (pcscd+0xd6b26) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)

  Previous read of size 4 at 0x7f123aafe310 by thread T10:
    #0 IFDHSetCapabilities CCID/src/ifdhandler.c:696:2 (libccid.so+0xb032) (BuildId: 34d145182e49b1532fafda06218243582b2f9366)
    #1 IFDSetCapabilities PCSC/src/ifdwrapper.c:221:7 (pcscd+0xe6bc7) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #2 SCardSetAttrib PCSC/src/winscard.c:1470:7 (pcscd+0xe6bc7)
    #3 ContextThread PCSC/src/winscard_svc.c:792:16 (pcscd+0xe6bc7)
    #4 __tsan_thread_start_func <null> (pcscd+0x53d66) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #5 __tsan_thread_start_func <null> (pcscd+0x53d66) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)

  As if synchronized via sleep:
    #0 nanosleep <null> (pcscd+0x515ed) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #1 SYS_USleep PCSC/src/sys_unix.c:87:9 (pcscd+0xd709a) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #2 EHStatusHandlerThread PCSC/src/eventhandler.c (pcscd+0xd709a)
    #3 __tsan_thread_start_func <null> (pcscd+0x53d66) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)

  Location is global 'LogLevel' of size 4 at 0x7f123aafe310 (libccid.so+0x22310)

  Mutex M0 (0x7b0c00000ed0) created at:
    #0 pthread_mutex_init <null> (pcscd+0x555cf) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #1 RFAddReader PCSC/src/readerfactory.c:355:9 (pcscd+0xdb5aa) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #2 HPAddDevice PCSC/src/hotplug_libudev.c:512:8 (pcscd+0xe33c9) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #3 HPScanUSB PCSC/src/hotplug_libudev.c:579:3 (pcscd+0xe29dd) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #4 HPRegisterForHotplugEvents PCSC/src/hotplug_libudev.c:761:2 (pcscd+0xe29dd)
    #5 main PCSC/src/pcscdaemon.c:766:7 (pcscd+0xd87e7) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)

  Thread T3 (tid=35793, running) created by main thread at:
    #0 pthread_create <null> (pcscd+0x53dfd) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #1 ThreadCreate PCSC/src/utils.c:184:8 (pcscd+0xe3c6b) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #2 EHSpawnEventHandler PCSC/src/eventhandler.c:233:7 (pcscd+0xd6910) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #3 RFAddReader PCSC/src/readerfactory.c:397:8 (pcscd+0xdb7ad) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #4 HPAddDevice PCSC/src/hotplug_libudev.c:512:8 (pcscd+0xe33c9) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #5 HPScanUSB PCSC/src/hotplug_libudev.c:579:3 (pcscd+0xe29dd) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #6 HPRegisterForHotplugEvents PCSC/src/hotplug_libudev.c:761:2 (pcscd+0xe29dd)
    #7 main PCSC/src/pcscdaemon.c:766:7 (pcscd+0xd87e7) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)

  Thread T10 (tid=40070, running) created by main thread at:
    #0 pthread_create <null> (pcscd+0x53dfd) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #1 ThreadCreate PCSC/src/utils.c:184:8 (pcscd+0xe3c6b) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #2 CreateContextThread PCSC/src/winscard_svc.c:239:7 (pcscd+0xd931e) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #3 SVCServiceRunLoop PCSC/src/pcscdaemon.c:131:9 (pcscd+0xd931e)
    #4 main PCSC/src/pcscdaemon.c:799:2 (pcscd+0xd88e0) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)
    #5 main PCSC/src/pcscdaemon.c:799:2 (pcscd+0xd88e0) (BuildId: 4d1e07aaf5145539b5a42a2ed57bb9b51830ddfe)

SUMMARY: ThreadSanitizer: data race CCID/src/ifdhandler.c:1986:12 in IFDHICCPresence
==================
LudovicRousseau added a commit that referenced this issue Oct 23, 2023
@LudovicRousseau
Fix thread safe issue
765b338 
Declare ReaderIndex[] as _Atomic as it can be accessed from 2 different
threads.

==================
WARNING: ThreadSanitizer: data race (pid=4017)
  Write of size 4 at 0x7fd1b32be970 by main thread (mutexes: write M0, write M1):
    #0 ReleaseReaderIndex CCID/src/utils.c:81:21 (libccid.so+0xa672) (BuildId: 69b3a74d7af87f05c5edb71935a43b024a0fe968)
    #1 FreeChannel CCID/src/ifdhandler.c:92:2 (libccid.so+0xa672)
    #2 IFDHCloseChannel CCID/src/ifdhandler.c:302:2 (libccid.so+0xa672)
    #3 IFDCloseIFD PCSC/src/ifdwrapper.c:190:7 (pcscd+0xd9e30) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #4 RFUnInitializeReader PCSC/src/readerfactory.c:1153:9 (pcscd+0xd9e30)
    #5 removeReader PCSC/src/readerfactory.c:645:2 (pcscd+0xd9e30)
    #6 _UnrefReader PCSC/src/readerfactory.c:120:3 (pcscd+0xd9e30)
    #7 IFDCloseIFD PCSC/src/ifdwrapper.c:190:7 (pcscd+0xd9e30) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #8 RFUnInitializeReader PCSC/src/readerfactory.c:1153:9 (pcscd+0xd9e30)
    #9 removeReader PCSC/src/readerfactory.c:645:2 (pcscd+0xd9e30)
    #10 _UnrefReader PCSC/src/readerfactory.c:120:3 (pcscd+0xd9e30)
    #11 RFRemoveReader PCSC/src/readerfactory.c:624:5 (pcscd+0xdd282) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #12 RFRemoveReader PCSC/src/readerfactory.c:624:5 (pcscd+0xdd282) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #13 RFRemoveReader PCSC/src/readerfactory.c:624:5 (pcscd+0xdd282) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #14 RFCleanupReaders PCSC/src/readerfactory.c:1396:9 (pcscd+0xddb9e) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #15 SVCServiceRunLoop PCSC/src/pcscdaemon.c:123:4 (pcscd+0xd9574) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #16 main PCSC/src/pcscdaemon.c:801:2 (pcscd+0xd8810) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)

  Previous read of size 4 at 0x7fd1b32be970 by thread T7:
    #0 LunToReaderIndex CCID/src/utils.c:72:14 (libccid.so+0xf8aa) (BuildId: 69b3a74d7af87f05c5edb71935a43b024a0fe968)
    #1 IFDHPolling CCID/src/ifdhandler.c:313:28 (libccid.so+0xb1bf) (BuildId: 69b3a74d7af87f05c5edb71935a43b024a0fe968)
    #2 EHStatusHandlerThread PCSC/src/eventhandler.c:467:10 (pcscd+0xd6f9b) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)

  As if synchronized via sleep:
    #0 nanosleep <null> (pcscd+0x515ed) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #1 SYS_Sleep PCSC/src/sys_unix.c:69:9 (pcscd+0xdfbf9) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #2 SVCServiceRunLoop PCSC/src/pcscdaemon.c:117:10 (pcscd+0xd956a) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #3 main PCSC/src/pcscdaemon.c:801:2 (pcscd+0xd8810) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)

  Location is global 'ReaderIndex' of size 64 at 0x7fd1b32be970 (libccid.so+0x22970)

  Mutex M0 (0x7b0c00000ed0) created at:
    #0 pthread_mutex_init <null> (pcscd+0x555cf) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #1 RFAddReader PCSC/src/readerfactory.c:355:9 (pcscd+0xdb4b7) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #2 HPAddDevice PCSC/src/hotplug_libudev.c:512:8 (pcscd+0xe3409) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #3 HPScanUSB PCSC/src/hotplug_libudev.c:579:3 (pcscd+0xe2a1d) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #4 HPRegisterForHotplugEvents PCSC/src/hotplug_libudev.c:761:2 (pcscd+0xe2a1d)
    #5 main PCSC/src/pcscdaemon.c:768:7 (pcscd+0xd8717) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)

  Mutex M1 (0x7fd1b32be948) created at:
    #0 pthread_mutex_lock <null> (pcscd+0x71ada) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #1 CreateChannelByNameOrChannel CCID/src/ifdhandler.c:119:8 (libccid.so+0x82ae) (BuildId: 69b3a74d7af87f05c5edb71935a43b024a0fe968)
    #2 IFDHCreateChannelByName CCID/src/ifdhandler.c:233:9 (libccid.so+0x7e55) (BuildId: 69b3a74d7af87f05c5edb71935a43b024a0fe968)
    #3 IFDOpenIFD PCSC/src/ifdwrapper.c:136:9 (pcscd+0xdd0cb) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #4 RFInitializeReader PCSC/src/readerfactory.c:1121:8 (pcscd+0xdd0cb)
    #5 RFAddReader PCSC/src/readerfactory.c:366:7 (pcscd+0xdb52a) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #6 RFAddReader PCSC/src/readerfactory.c:366:7 (pcscd+0xdb52a) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #7 HPAddDevice PCSC/src/hotplug_libudev.c:512:8 (pcscd+0xe3409) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #8 HPScanUSB PCSC/src/hotplug_libudev.c:579:3 (pcscd+0xe2a1d) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #9 HPRegisterForHotplugEvents PCSC/src/hotplug_libudev.c:761:2 (pcscd+0xe2a1d)
    #10 main PCSC/src/pcscdaemon.c:768:7 (pcscd+0xd8717) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)

  Thread T7 (tid=4049, running) created by thread T4 at:
    #0 pthread_create <null> (pcscd+0x53dfd) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #1 ThreadCreate PCSC/src/utils.c:184:8 (pcscd+0xe3cab) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #2 EHSpawnEventHandler PCSC/src/eventhandler.c:233:7 (pcscd+0xd6840) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #3 RFAddReader PCSC/src/readerfactory.c:397:8 (pcscd+0xdb6ba) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #4 HPAddDevice PCSC/src/hotplug_libudev.c:512:8 (pcscd+0xe3409) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)
    #5 HPEstablishUSBNotifications PCSC/src/hotplug_libudev.c:646:6 (pcscd+0xe3783) (BuildId: 046d0874ce19c882d4f3b8ab5213aa4cd336cd5e)

SUMMARY: ThreadSanitizer: data race CCID/src/utils.c:81:21 in ReleaseReaderIndex
==================
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@martinpaljak @LudovicRousseau