Question

我有一个目前似乎在Linux上运行良好的程序（Ubuntu 14.04），但是当在OS X（10.11.6）上运行时，我得到一个中止陷阱6.我已经附加了我的代码，但我怀疑问题实际上与特定代码无关。这段代码适用于一个类项目，我实际上并没有尝试破解密码或任何东西。

这里是代码，我相信所有重要的东西都发生在主要内容中。

#include <openssl/aes.h>   
#include <openssl/evp.h>
#include <openssl/conf.h>
#include <openssl/err.h>


#define KEY_BYTES KEY_LENGTH/8
#define KEY_LENGTH 128


unsigned char*  h(unsigned char* p, unsigned char* hp);
void handleErrors(void);
int encrypt(unsigned char *plaintext, int plaintext_len, unsigned char *key,
            unsigned char *iv, unsigned char *ciphertext);


//assumes we've already padded with zeros
unsigned char*  h(unsigned char* p, unsigned char *hp){
    encrypt((unsigned char*)"0000000000000000", KEY_BYTES, p , (unsigned char*)"0000000000000000", hp);
    return hp; 
}

void handleErrors(void)
{
    printf("panic!!\n");
    //ERR_print_errors_fp(stderr); //sg: throw a real error you fool!
    abort();
}

//sg: stolen from the evp man page
int encrypt(unsigned char *plaintext, int plaintext_len, unsigned char *key,
            unsigned char *iv, unsigned char *ciphertext)
{
    EVP_CIPHER_CTX *ctx;

    int len;

    int ciphertext_len;

    /* Create and initialise the context */
    if(!(ctx = EVP_CIPHER_CTX_new())) handleErrors();

    /* Initialise the encryption operation. IMPORTANT - ensure you use a key
     * and IV size appropriate for your cipher
     * In this example we are using 256 bit AES (i.e. a 256 bit key). The
     * IV size for *most* modes is the same as the block size. For AES this
     * is 128 bits */
    if(1 != EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv))
        handleErrors();

    /* Provide the message to be encrypted, and obtain the encrypted output.
     * EVP_EncryptUpdate can be called multiple times if necessary
     */
    if(1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
        handleErrors();
    ciphertext_len = len;

    /* Finalise the encryption. Further ciphertext bytes may be written at
     * this stage.
     */
    if(1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len)) handleErrors();
    ciphertext_len += len;

    /* Clean up */
    EVP_CIPHER_CTX_free(ctx);

    return ciphertext_len;
}


int main(){

    /* Initialise the library */
    ERR_load_crypto_strings();
    OpenSSL_add_all_algorithms();
    OPENSSL_config(NULL);

    EVP_CIPHER_CTX *ctx;
    unsigned char hp[KEY_BYTES];

    /* Create and initialise the context */
    if(!(ctx = EVP_CIPHER_CTX_new())) handleErrors();

    h((unsigned char*) "1111111111111111", hp);

    for(int i = 0; i < KEY_BYTES; i++){
        printf("h(%i) = %x\n", i, hp[i]);
    }

    return 0;
}

在linux上运行时，我得到以下内容（这是我期望的）

h(0) = 10
h(1) = df
h(2) = c1
h(3) = b5
h(4) = f6
h(5) = 6c
h(6) = fd
h(7) = 6a
h(8) = 1d
h(9) = c4
h(10) = 6d
h(11) = 66
h(12) = 90
h(13) = 7b
h(14) = ee
h(15) = b1

然而，当我在OS X上运行时，我得到以下内容：

h(0) = 10
h(1) = df
h(2) = c1
h(3) = b5
h(4) = f6
h(5) = 6c
h(6) = fd
h(7) = 6a
h(8) = 1d
h(9) = c4
h(10) = 6d
h(11) = 66
h(12) = 90
h(13) = 7b
h(14) = ee
h(15) = b1
Abort trap: 6

当我将其弹出到gdb中时，我得到以下内容

(gdb) r
Starting program: /Users/sgillen/Code/457/proj3/a.out 
h(0) = 10
h(1) = df
h(2) = c1
h(3) = b5
h(4) = f6
h(5) = 6c
h(6) = fd
h(7) = 6a
h(8) = 1d
h(9) = c4
h(10) = 6d
h(11) = 66
h(12) = 90
h(13) = 7b
h(14) = ee
h(15) = b1

Program received signal SIGABRT, Aborted.
0x00007fff93150f06 in __pthread_kill () from /usr/lib/system/libsystem_kernel.dylib
(gdb) where
#0  0x00007fff93150f06 in __pthread_kill () from /usr/lib/system/libsystem_kernel.dylib
#1  0x00007fff97b374ec in pthread_kill () from /usr/lib/system/libsystem_pthread.dylib
#2  0x00007fff9ba8077f in __abort () from /usr/lib/system/libsystem_c.dylib
#3  0x00007fff9ba8105e in __stack_chk_fail () from /usr/lib/system/libsystem_c.dylib
#4  0x0000000100000ea9 in main () at gen_table.cpp:90

不确定如何在堆栈溢出时执行行号，但是gen_table.cpp的第90行是main中的最后一个返回0。

如果相关的话，我用以下代码编译我的代码。

clang -Wall -std=c++11 gen_table.cpp  -I/usr/local/opt/openssl/include/ -lcrypto -lssl -g

非常感谢任何帮助，谢谢！

Answer 1

我找到了我的问题的答案，我想我会为其他任何以某种方式遇到同样问题的人发布答案。问题是我覆盖了自己的堆栈。我使用的加密函数实际上是将32个字节写入hp（这是一个16字节的无符号字符串，存在于堆栈中）。所以我会破坏自己的堆栈但不写入我的进程不拥有的任何内存。这导致没有seg故障，但是当程序试图返回时，最终出现了问题。杀死我的确切事情取决于我编译代码的方式。

我真的很惊讶瓦格林德没有抓住这一点。而且我仍然不知道为什么它在使用clang编译时在linux上工作正常（用g ++编译我得到了一个堆栈粉碎检测到的错误）。

编辑：要清楚解决方案是修复我的加密实现，以便它只写16个字节。我只是通过评论EVP_EncryptFinal_ex调用来做到这一点。

从OS X中的main返回时中止陷阱6但不在linux上

1 个答案: