[9fans] dial and buffer overflow

["Mathieu L." <lejatorn@gmail.com>]

Hello all,

I have this piece of code that looks like this:

	for (int i=0; i<5 ; i++){
		for (int j=0; j<HASHSIZE; j++)
			print("%.2ux", (tor->sha1list)[i][j]);
		print("\n");
	}

	print("addr called: %s\n",netmkaddr(address, "tcp", port));
	ctlfd = dial(netmkaddr(address, "tcp", port), 0, 0, 0);
	if(ctlfd < 0){
		fprint(2, "can't dial %s: %r\n", address);
		exits("dialing");
	}

	for (int i=0; i<5 ; i++){
		for (int j=0; j<HASHSIZE; j++)
			print("%.2ux", (tor->sha1list)[i][j]);
		print("\n");
	}

which gives that kind of input:

f8c3f943edf54d28e3f894e9416d5312a49c3916
5d7a30beaef2b56a06b8aea37cd3263698825ec3
b456f6749bf907233c183c04277569aa0833e386
3e2d9cee1e07d3d770f1a6081a006394cb4b35d3
c43a3bd4caa813a75f58096068309ede6e96cacd
addr called: tcp!127.0.0.1!6895
6970000034930300eb9803000e0000000e000000
5d7a30bed80802313cc70000349303003ffd0100
b456f6749bf907233c183c04277569aa0833e386
3e2d9cee1e07d3d770f1a6081a006394cb4b35d3
c43a3bd4caa813a75f58096068309ede6e96cacd

so it seems like something happens when calling dial which modifies what
I have in memory pointed by tor->sha1list[i], and that is of course not
what I want, as those values should have nothing to do with the call to
dial itself.

the various tor->sha1list[i][j] were allocated and set earlier in the
code, and I don't think I wrote out of their boundaries when I did so
since I can free() them all just before the call to dial() without getting
an error. Although I'm not sure that's a conclusive enough test, is it?

It's on 9vx so I can't use acid or leak since both systematically freeze
9vx here.

Does anyone have an idea on what I'm doing wrong or how to debug that
further?

Thanks,
Mathieu