[comp.sources.bugs] screen bug

mcp2@csd4.milw.wisc.edu (Michael C Polinske) (03/04/89)

Last night while working on the system I discovered a very serious bug
in the screen program:

The system was very busy, and I was working away trying to get my
program done.  I gave the command to open up another window "C-a c."
After about 15 seconds the window opened.  But some thing was
different.  I didn't have my normal prompt, I had what appeared to be
someone else's.  I did a pwd and it showed that I was in another
person's directory.  I did a whoami and it showed that I was the
person whose directory I was in.

So, I issued the login command.  The command executed fine, but
because I have my .login set up so that I go right into screen, it set
up another set of screens.  but the commands would only work in the
first set.

I next killed all of the current screens that I could, logged out of
the main tty that I was on and logged in again.  I checked what
processes I had running and found theat the jobs on the pty where I
did a login were still running.  So i killed those and yet I was still
taking up that pty.  In tcsh it is supposed to automatically log you
out, well according to the `w' command I am still logged in there
doing nothing and a idle time of about 24 hours.

So I guess I'll be taking up that port until the system goes down.

What apparently happened was because ttys were rare with the high
number of users, and the person who had just been on that pty  just
turned of the terminal instead of logging out and I just happened to
go into that pty before the computer had a chance to completely close
the previous connection.

I hope that in the next release of screen the author(who?) includes a
routine that will double check that the pty is closed before opening
it up to set up another window.
--
|snail mail: Michael Charles Polinske	|email:	mcp2@csd4.milw.wisc.edu	|
|	     5730 North 68th St.	|			       	|
|	     Milwaukee, WI 53218	|Telephone: 1+(414) 461-3717   	|

net@tub.UUCP (Oliver Laumann) (03/05/89)

In article <MCP2.89Mar3163135@csd4.milw.wisc.edu> mcp2@csd4.milw.wisc.edu (Michael C Polinske) writes:
> Last night while working on the system I discovered a very serious bug
> in the screen program:
[opening a window gets connected to another person's login session]

This is a bug in the pseudo-tty implementation rather than a bug
in screen.  It should not be possible to allocate a pty that has
not been closed.

Regards,
--
Oliver Laumann              net@TUB.BITNET              net@tub.UUCP