| Bug ID |
10120
|
| Summary |
Clang ASAN : global-buffer-overflow GSM RLCMAC : dissect_dl_rlc_control_message
|
| Classification |
Unclassified
|
| Product |
Wireshark
|
| Version |
Git
|
| Hardware |
All
|
| OS |
All
|
| Status |
UNCONFIRMED
|
| Severity |
Minor
|
| Priority |
Low
|
| Component |
Dissection engine (libwireshark)
|
| Assignee |
[email protected]
|
| Reporter |
[email protected]
|
Build Information:
Paste the COMPLETE build information from "Help->About Wireshark", "wireshark
-v", or "tshark -v".
--
I fuzzing wireshark with ASAN (
http://clang.llvm.org/docs/AddressSanitizer.html) and it found the following
issue :
Input file: ../menagerie/public/10093-csnStreamDissector.pcap (
https://bugs.wireshark.org/bugzilla/attachment.cgi?id=10093 )
=================================================================
==16842==ERROR: AddressSanitizer: global-buffer-overflow on address
0x7fb41491f2e8 at pc 0x7fb410af4124 bp 0x7fff208cd59 0 sp 0x7fff208cd588
READ of size 8 at 0x7fb41491f2e8 thread T0
#0 0x7fb410af4123 in ProcessError
/home/alagoutte/wireshark-clang/epan/dissectors/packet-csn1.c:103
(discriminator 1)
#1 0x7fb410aedefd in csnStreamDissector
/home/alagoutte/wireshark-clang/epan/dissectors/packet-csn1.c:1052
#2 0x7fb410aef971 in csnStreamDissector
/home/alagoutte/wireshark-clang/epan/dissectors/packet-csn1.c:567
#3 0x7fb410aedefd in csnStreamDissector
/home/alagoutte/wireshark-clang/epan/dissectors/packet-csn1.c:1052
#4 0x7fb410d1fc7d in dissect_dl_rlc_control_message
/home/alagoutte/wireshark-clang/epan/dissectors/packet-gsm_rlcmac.c :7272
#5 0x7fb410809cea in call_dissector_through_handle
/home/alagoutte/wireshark-clang/epan/packet.c:592
#6 0x7fb41080d03c in call_dissector_only
/home/alagoutte/wireshark-clang/epan/packet.c:2251
#7 0x7fb410809d19 in call_dissector_through_handle
/home/alagoutte/wireshark-clang/epan/packet.c:596
#8 0x7fb410809f99 in dissector_try_uint_new
/home/alagoutte/wireshark-clang/epan/packet.c:1114
#9 0x7fb411359b9d in decode_udp_ports
/home/alagoutte/wireshark-clang/epan/dissectors/packet-udp.c:415
#10 0x7fb41135cec3 in dissect
/home/alagoutte/wireshark-clang/epan/dissectors/packet-udp.c:766
#11 0x7fb410809d19 in call_dissector_through_handle
/home/alagoutte/wireshark-clang/epan/packet.c:596
#12 0x7fb410809968 in dissector_try_uint_new
/home/alagoutte/wireshark-clang/epan/packet.c:1114
#13 0x7fb410dfa70a in dissect_ip
/home/alagoutte/wireshark-clang/epan/dissectors/packet-ip.c:2408
#14 0x7fb410809d19 in call_dissector_through_handle
/home/alagoutte/wireshark-clang/epan/packet.c:596
#15 0x7fb410809f99 in dissector_try_uint_new
/home/alagoutte/wireshark-clang/epan/packet.c:1114
#16 0x7fb410c4bc3a in dissect_ethertype
/home/alagoutte/wireshark-clang/epan/dissectors/packet-ethertype.c:303
#17 0x7fb410809cea in call_dissector_through_handle
/home/alagoutte/wireshark-clang/epan/packet.c:592
#18 0x7fb41080d03c in call_dissector_only
/home/alagoutte/wireshark-clang/epan/packet.c:2251
#19 0x7fb410c4a796 in dissect_eth_common
/home/alagoutte/wireshark-clang/epan/dissectors/packet-eth.c:470
#20 0x7fb410809d19 in call_dissector_through_handle
/home/alagoutte/wireshark-clang/epan/packet.c:596
#21 0x7fb410809f99 in dissector_try_uint_new
/home/alagoutte/wireshark-clang/epan/packet.c:1114
#22 0x7fb410c96e53 in dissect_frame
/home/alagoutte/wireshark-clang/epan/dissectors/packet-frame.c:488
#23 0x7fb410809d19 in call_dissector_through_handle
/home/alagoutte/wireshark-clang/epan/packet.c:596
#24 0x7fb41080d03c in call_dissector_only
/home/alagoutte/wireshark-clang/epan/packet.c:2251
#25 0x7fb410807c84 in call_dissector
/home/alagoutte/wireshark-clang/epan/packet.c:2281
#26 0x7fb4107ea418 in epan_dissect_run_with_taps
/home/alagoutte/wireshark-clang/epan/epan.c:348
#27 0x4d44db in process_packet
/home/alagoutte/wireshark-clang/tshark.c:3537
#28 0x4cf8df in load_cap_file /home/alagoutte/wireshark-clang/tshark.c:3327
#29 0x7fb4094e4de4 in __libc_start_main
/build/buildd/eglibc-2.17/csu/libc-start.c:260
#30 0x4ba62c in _start ??:?
0x7fb41491f2e8 is located 32 bytes to the right of global variable
'CSNDESCR_PHO_EGPRS_t' from 'packet-gsm_rlcmac.c' (0x 7fb41491f060) of size
616
SUMMARY: AddressSanitizer: global-buffer-overflow ??:0 ??
Shadow bytes around the buggy address:
0x0ff70291be00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
0x0ff70291be10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff70291be20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff70291be30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff70291be40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff70291be50: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9[f9]f9 f9
0x0ff70291be60: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
0x0ff70291be70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ff70291be80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9
0x0ff70291be90: f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
0x0ff70291bea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
ASan internal: fe
==16842==ABORTING
You are receiving this mail because:
- You are watching all bug changes.
