Skip to content

Crash during garmintool download #17

@phako

Description

@phako

Looks like some length is off. I can see the whole environment dumped in the packet, so probably array overflow

#0  0x00007f6937574f86 in garmin_print_packet (p=0x7ffdbb50dc00, dir=1, fp=0x7f69373db6a0 <_IO_2_1_stdout_>) at ../src/usb_comm.c:422
        i = 25588
        j = 4
        s = 771751936
        hex = " 00 00 00 00\000\066d 69 6e 74 6f 6f 6c 00 00 00 00 00", '\000' <repeats 79 times>
        dec = "____\000intool_____", '\000' <repeats 111 times>
#1  0x00007f6937574abe in garmin_read (garmin=0x7ffdbb512200, p=0x7ffdbb50dc00) at ../src/usb_comm.c:339
        r = 35
#2  0x00007f6937584347 in garmin_read_records2 (garmin=0x7ffdbb512200, pid1=Pid_Trk_Hdr, type1=data_D311, pid2=Pid_Trk_Data, type2=data_D304) at ../src/protocol.c:344
        d = 0x5582556879a0
        l = 0x5582556879c0
        p = {packet = {type = 0 '\000', reserved1 = 0 '\000', reserved2 = 0 '\000', reserved3 = 34 '"', id = "\000", reserved4 = 0 '\000', reserved5 = 24 '\030', size = "\000\000\000.", data = "l\037&\002;\v\a\366WN9\000\254\271An[\257Ey\377\000\000\000\375\177\000\000\000\026\370T\202U\000\000\200$Q\273\375\177", '\000' <repeats 18 times>, "\207Q[7i\177\000\000\005", '\000' <repeats 15 times>, "\220\340P\273\375\177\000\000\320\022W7i\177\000\000\060\340P\273\375\177\000\000n\313[7i\177\000\000\000\"Q\273\375\177\000\000!\242\347\372\000\000\000\000\002", '\000' <repeats 16 times>, "\"Q\273\375\177\000\000\200yhU\202U\000\000\377\000\000\000\000\000\000\000n\313[7i\177\000\000\000\"Q\273\375\177\000\000!\242\347\372\000\000\000\000\002\000\000\000\000\000\000\000"...}, data = "\000\000\000\"\000\000\000\030\000\000\000.l\037&\002;\v\a\366WN9\000\254\271An[\257Ey\377\000\000\000\375\177\000\000\000\026\370T\202U\000\000\200$Q\273\375\177", '\000' <repeats 18 times>, "\207Q[7i\177\000\000\005", '\000' <repeats 15 times>, "\220\340P\273\375\177\000\000\320\022W7i\177\000\000\060\340P\273\375\177\000\000n\313[7i\177\000\000\000\"Q\273\375\177\000\000!\242\347\372\000\000\000\000\002", '\000' <repeats 16 times>, "\"Q\273\375\177\000\000\200yhU\202U\000\000\377\000\000\000\000\000\000\000n\313[7i\177\000\000\000\"Q\273\375\177\000\000"...}
        link = link_L001
        expected = 13064
        got = 8646
        state = 2
        ppid = Pid_Trk_Data
#3  0x00007f6937584ea3 in garmin_read_a301 (garmin=0x7ffdbb512200) at ../src/protocol.c:723
        d = 0x0
#4  0x00007f6937584ec9 in garmin_read_a302 (garmin=0x7ffdbb512200) at ../src/protocol.c:741
No locals.
#5  0x00007f6937585164 in garmin_read_a1000 (garmin=0x7ffdbb512200) at ../src/protocol.c:888
        d = 0x55825567cd20
        l = 0x558255694930
#6  0x00007f6937585a24 in garmin_read_via (garmin=0x7ffdbb512200, protocol=appl_A1000) at ../src/protocol.c:1131
        data = 0x0
#7  0x00007f6937585d29 in garmin_get (garmin=0x7ffdbb512200, what=GET_RUNS) at ../src/protocol.c:1166
        data = 0x0
#8  0x00007f6937595304 in garmin_save_runs (garmin=0x7ffdbb512200) at ../src/run.c:266
        data = 0x0
        data0 = 0x0
        data1 = 0x0
        data2 = 0x0
        rlaps = 0x0
        rtracks = 0x0
        runs = 0x0
        laps = 0x0
        tracks = 0x0
        rlist = 0x0
        n = 0x0
        m = 0x0
        trk = 0
        f_lap = 0
        l_lap = 0
        l_idx = 0
        start = 0
        start_time = 0
        filename = '\000' <repeats 8191 times>
        filedir = 0x55825567f870 "/home/jens/Source/garmintools"
        path = 0x0
        filepath = '\000' <repeats 8191 times>
        tbuf = 0x0
#9  0x0000558254f82105 in garmin_download (argc=2, argv=0x7ffdbb512490) at ../src/garmin_save_runs.c:76
        garmin = {id = 0, product = {product_id = 484, software_version = 290, product_description = 0x55825567cee0 "Forerunner305 Software Version 2.90", additional_data = 0x0}, extended = {ext_data = 0x55825567cd00}, protocol = {physical = phys_P000, link = link_L001, command = appl_A010, waypoint = {waypoint = appl_A100, category = appl_Anil, proximity = appl_Anil}, route = appl_A201, track = appl_A302, almanac = appl_A500, date_time = appl_A600, flightbook = appl_Anil, position = appl_A700, pvt = appl_A800, lap = appl_A906, run = appl_A1000, workout = {workout = appl_A1002, occurrence = appl_A1003, limits = appl_A1005}, fitness = appl_A1004, course = {course = appl_A1006, lap = appl_A1007, track = appl_Anil, point = appl_A1008, limits = appl_A1009}}, datatype = {waypoint = {waypoint = data_D110, category = data_Dnil, proximity = data_Dnil}, route = {header = data_D202, waypoint = data_D110, link = data_D210}, track = {header = data_D311, data = data_D304}, almanac = data_D501, date_time = data_D600, flightbook = data_Dnil, position = data_D700, pvt = data_D800, lap = data_D1015, run = data_D1009, workout = {workout = data_D1008, occurrence = data_D1003, limits = data_D1005}, fitness = data_D1004, course = {course = data_D1006, lap = data_D1007, track = {header = data_Dnil, data = data_Dnil}, point = data_D1012, limits = data_D1013}}, usb = {handle = 0x55825567c0a0, bulk_out = 2, bulk_in = 131, intr_in = 129, read_bulk = 0}, verbose = 1}
        options = {{name = 0x558254f864dc "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x558254f86509 "verbose", has_arg = 0, flag = 0x558254f8a5b4 <verbose>, val = 1}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
#10 0x0000558254f8174b in handle_command (argc=2, argv=0x7ffdbb512490) at ../src/garmintool.c:108
        p = 0x558254f8a150 <commands+48>
#11 0x0000558254f81a78 in main (original_argc=3, original_argv=0x7ffdbb512488) at ../src/garmintool.c:206
        argv = 0x7ffdbb512490
        argc = 2
        free_argv = false
        retval = 1

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions