Skip to content

Conversation

@michaelortmann
Copy link
Member

@michaelortmann michaelortmann commented Oct 13, 2025

Found by: https://github.com/michaelortmann/
Patch by: https://github.com/michaelortmann/
Fixes: #1762

One-line summary:

Additional description (if needed):
get_data_ptr() -> n_malloc() could destroy line, so copy line to line_r to make append_line() reentrant
Turn paging off before booting a user in case of too many page lines to avoid infinite loop
Rise max page lines from 1000 to 2000
Add tcl command doc for tcl_page
Remember: If user is for example HQ, then do_boot() will automatically re-login, and set the console page status to the value stored in console mod, if that mod is loaded, eventually triggering an infinite loop / segfault.
In addition to finding the bug in February 2025 with #1762, and fixing it, i have now also been able to automatically find it flexing https://github.com/AFLplusplus/AFLplusplus

Test cases demonstrating functionality (if applicable):
Create a motd with 1003 lines

> wc -l text/motd
1003 text/motd

log in with HQ, like with ./eggdrop -t eggdrop.conf

.page 5
.motd
[...]
`Segmentation fault         (core dumped) ./eggdrop -t BotA.conf`

This was only one example to trigger the bug. Another one is having many ignores and doing the following will crash the bot:

.page 5
.ignores

@michaelortmann michaelortmann changed the title Crash fix paging WIP: Crash fix paging Oct 13, 2025
@michaelortmann michaelortmann changed the title WIP: Crash fix paging Crash fix paging Oct 13, 2025
@vanosg vanosg added this to the v1.10.2 milestone Nov 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash append_line()

2 participants