40

I have a problem compiling the following exploit code:

http://downloads.securityfocus.com/vulnerabilities/exploits/59846-1.c

I am using "gcc file.c" and "gcc -O2 file.c", but both of them results in the following errors:

sorbolinux-exec.c: In function ‘sc’:
sorbolinux-exec.c:76: error: stray ‘\302’ in program
sorbolinux-exec.c:76: error: stray ‘\244’ in program
sorbolinux-exec.c:76: error: ‘t’ undeclared (first use in this function)
sorbolinux-exec.c:76: error: (Each undeclared identifier is reported only  once
sorbolinux-exec.c:76: error: for each function it appears in.)

I tried compiling them on both Kali Linux and Ubuntu 10.04 (Lucid Lynx) and got the same result.

25
  • Sounds to me like your files contain "national" characters that are not in legal in identifiers or some such. But you really should include in your question the lines that get these errors.
    – Hot Licks
    Oct 5, 2013 at 13:29
  • Error messages say everything.
    – this
    Oct 5, 2013 at 13:39
  • 3
    \302\244 is the octal representation of the UTF-8 sequence 0xC2 0xA4, which is the currency sign: ¤.
    – Codo
    Oct 5, 2013 at 13:45
  • 2
    This question is the canonical question for the stray character problems often encountered when copy pasting code from webpages, PDF documents, or through chat (e.g., Skype Chat or Facebook Messenger). Thus, it deserves comprehensive answers. Currently, only twitchdotcom slash KANJICODER's answer fits that bill. Mar 5, 2021 at 5:10
  • A common one is stray ‘\342’ ‘\200’ ‘\213’ (octal numbers - UTF-8 byte sequence 0xE2 0x80 0x8B, Unicode code point U+200B (ZERO WIDTH SPACE)). A search/replace in regular expression mode in Geany for \x{200B} worked. Mar 5, 2021 at 10:36

12 Answers 12

28

You have an invalid character on that line. This is what I saw:

enter image description here

7
  • thanks, but this removes only 2 lines of errors and still these errors exist raw.c: In function ‘sc’: raw.c:76: error: ‘t’ undeclared (first use in this function) raw.c:76: error: (Each undeclared identifier is reported only once raw.c:76: error: for each function it appears in.) Oct 5, 2013 at 13:45
  • 1
    @AhmedTaher: The fix certainly removes the error messages in your question. If other errors remain, please add them to your question.
    – Codo
    Oct 5, 2013 at 13:47
  • 5
    Most likely the line uint64_t *p = (void *) ¤t[i]; needs to be changed to uint64_t *p = (void *) &current[i];. (¤ is the HTML entity for the currency sign.
    – Codo
    Oct 5, 2013 at 13:50
  • If you remove the currency sign from your code, these error messages can no longer be produced. It's simply impossible.
    – Codo
    Oct 5, 2013 at 13:52
  • 1
    The real explanation is that browsers used to compete a lot on their ability to render really bad HTML code with lots of mistakes in it. OP's browser, when displaying the code example, saw a sequence of characters that began with an ampersand and ended with a semicolon, that didn't exactly match an HTML entity, but was close, and it decided to do the replacement, but also show the extra text...this was an HTML parsing error on the part of the browser, because it was trying to be too helpful. May 11, 2018 at 18:03
18

You have invalid characters in your source. If you don't have any valid non-ASCII characters in your source, maybe in a double quoted string literal, you can simply convert your file back to ASCII with:

tr -cd '\11\12\15\40-\176' < old.c > new.c

The method with iconv will stop at wrong characters which makes no sense. The above command line is working with the example file.

0
6

Sure, convert the file to ASCII and blast all Unicode characters away. It will probably work... But...

  1. You won't know what you fixed.
  2. It will also destroy any Unicode comments. Example: //: A²+B²=C²
  3. It could potentially damage obvious logic and the code will still be broken, but the solution less obvious. For example: A string with "Smart-Quotes" (“ & ”) or a pointer with a full-width asterisk (*). Now “SOME_THING” looks like a #define (SOME_THING) and *SomeType is the wrong type (SomeType).

Two more surgical approaches to fixing the problem:

  1. Switch fonts to see the character. (It might be invisible in your current font)

  2. Regular expression search all Unicode characters not part of non-extended ASCII.

    In Notepad++ I can search up to FFFF, which hasn't failed me yet.

    [\x{80}-\x{FFFF}]

    80 is hex for 128, the first extended ASCII character.

    After hitting "find next" and highlighting what appears to be empty space, you can close your search dialog and press Ctrl + C to copy to clipboard.

    Then paste the character into a Unicode search tool. I usually use an online one. http://unicode.scarfboy.com/

Example:

I had a bullet point (•) in my code somehow. The Unicode value is 2022 (hex), but when read as ASCII by the compiler you get \342 \200 \242 (3 octal values). It's not as simple as converting each octal values to hex and smashing them together. So "E2 80 A2" is not the hexadecimal Unicode point in your code.

5
4

I got the same with a character that visibly appeared as an asterisk, but it was a UTF-8 sequence instead:

Encoder * st;

When compiled, it returned:

g.c:2:1: error: stray ‘\342’ in program
g.c:2:1: error: stray ‘\210’ in program
g.c:2:1: error: stray ‘\227’ in program

342 210 227 turns out to be UTF-8 for ASTERISK OPERATOR (Unicode code point U+2217).

Deleting the '*' and typing it again fixed the problem.

3
  • A slightly more direct analysis is 226 136 151 (octal) → 0xE2 0x88 0x97 (hexadecimal) → UTF-8 sequence for Unicode code point U+2217 (ASTERISK OPERATOR). Jul 26, 2021 at 14:44
  • Alternatively, search/replace for \x{2217} in a text editor that supports regular expressions and Unicode (for example, Geany, Notepad++, or UltraEdit) Jul 26, 2021 at 18:26
  • *That should have been: "...342 210 227 (octal) → 0xE2 0x88 0x97 (hexadecimal)..." (the decimal numbers were correct, but they did not match the error message directly (numbers in octal)) May 16, 2023 at 1:18
2

Whenever the compiler found a special character, it gives these kind of compile errors. The error I found is as follows:

error: stray '\302' in program and error: stray '\240' in program

....

It is some piece of code I copied from a chat messenger. In Facebook Messenger, it was a special character only. After copying into the Vim editor it changed to the correct character only. But the compiler was giving the above error .. then .. that statement I wrote manually after .. it got resolved... :)

2

It's perhaps because you copied code from the Internet (from a site which has perhaps not an ASCII encoded page, but a UTF-8 encoded page), so you can convert the code to ASCII from this site:

"http://www.percederberg.net/tools/text_converter.html"

There you can either detect errors manually by converting it back to UTF-8, or you can automatically convert it to ASCII and remove all the stray characters.

1
  • Yes, that is a very common occurrence. Common ones from code on web pages are EN DASH, EM DASH, and MINUS SIGN (not the same as the ASCII one - UTF-8 sequence 0xE2 0x88 0x92). They can be searched/replaced for in text editors that support regular expression by \x{2013}, \x{2014}, and \x{2212}, respectively. Jul 26, 2021 at 14:16
1

This problem comes when you have copied some text from an HTML page or you have done modification in a Windows environment and are trying to compile in a Unix/Solaris environment.

Please do "dos2unix" to remove the special characters from the file:

dos2unix fileName.ext fileName.ext
1

Invalid character in your code.

It is a common copy-paste error, especially when code is copied from Microsoft Word documents or PDF files.

0

I noticed an issue in using the above tr command. The tr command COMPLETELY removes the "smart quotes". It would be better to replace the "smart quotes" with something like this.

This will give you a quick preview of what will be replaced.

sed s/[”“]/'"'/g File.txt

This will do the replacements and put the replacement in a new file called WithoutSmartQuotes.txt.

sed s/[”“]/'"'/g File.txt > WithoutSmartQuotes.txt

This will overwrite the original file.

sed -i ".bk" s/[”“]/'"'/g File.txt

http://developmentality.wordpress.com/2010/10/11/how-to-remove-smart-quotes-from-a-text-file/

1
  • But don't the tools need to be Unicode aware for this to work (at least in the general case)? Are they? Mar 5, 2021 at 4:50
0

Codo was exactly right on Oct. 5 that &current[i] is the intended text (with the currency symbol inadvertently introduced when the source was put into HTML (see original):

http://downloads.securityfocus.com/vulnerabilities/exploits/59846-1.c

Codo's change makes this exploit code compile without error. I did that and was able to use the exploit on Ubuntu 12.04 (Precise Pangolin) to escalate to root privilege.

0

The explanations given here are correct. I just wanted to add that this problem might be because you copied the code from somewhere, from a website or a PDF file due to which there are some invalid characters in the code.

Try to find those invalid characters, or just retype the code if you can't. It will definitely compile then.

Source: stray error reason

0

With me, this error occurred when I copied and pasted code in text format to my editor (gedit).

The code was in a text document (.odt). I copied it and pasted it into gedit.

If you did the same, you have manually rewrite the code.

1
  • Rewriting the code is not necessary. For instance, in Notepad++, you can search and replace for Unicode codepoints. E.g. \x{00A0} (identified by using a binary/hex view for the file) for a problem encountered by copying through Skype Chat. Mar 5, 2021 at 4:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.