5.1.0 Turris : HBL Squid segfault

Software SW bugs discussion
1

Hi,

Is it just me or a bug with any option segfaults.

Any ideas?

2

Would you mind sharing any output of the segfault? Maybe then some ideas show up.

3

Hi,

I get nothing at all, nothing logged and no errors back apart from segmentation fault. Weirdly even the help message fails to show though I suspect maybe there more issues with my installation as luci is also now inaccessible…

I used schnapps to import the Hbl medkit then did a rollback to upgrade as I couldn’t get an image to upload from usb…

I think I’ll try to do that again with the serial hooked up to see if something else is going on.

Cheers!

4

Hello @TheChaZ,

Thank you for reporting. This is related to ASLR PIE, which we have enabled by default.


For Turris MOX, this package is not built because of that reason, however, it passed for Turris Omnia, the compilation is one thing, but run time test is also necessary as it is different. But the run time test failed because of the same reason. If it segfaults for you, for example, strace is helpful to see what is going on.

I’m now pushing fixes to review and once they are merged, it will take a few hours to have new automatic builds with fixes included.

5

On the other hand, I think I’d rather see it that it does not work instead of being vulnerable. So, I take a look at it and updated it to the latest version, which is currently available and also added which CVEs it fixes.

Anyway, squid is not actively maintained in packages feed as you can see, and I would like to see it updated in OpenWrt 19.07 branch as well to protect all routers, who have running OpenWrt 19.07 with vulnerable squid.