Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 12920] New: Buildbot crash output: fuzz-2016-09-17-5537.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	12920
Summary	Buildbot crash output: fuzz-2016-09-17-5537.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2016-09-17-5537.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2016-09-17-5537.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/5750-avdtp_test.cap

Build host information:
Linux wsbb04 4.4.0-34-generic #53-Ubuntu SMP Wed Jul 27 16:06:39 UTC 2016
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 16.04.1 LTS
Release:    16.04
Codename:    xenial

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_WORKERNAME=clang-code-analysis
BUILDBOT_BUILDNUMBER=3694
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_GOT_REVISION=ede1af20ba483dd7b6b35d3bd1eabe5cc463592c

Return value:  1

Dissector bug:  0

Valgrind error count:  0



Git commit
commit ede1af20ba483dd7b6b35d3bd1eabe5cc463592c
Author: Martin Kaiser <wireshark@kaiser.cx>
Date:   Sat Sep 17 18:46:26 2016 +0200

    eap: make eap_identity_prefix a numeric item

    This used to be string item, its value was not 0-terminated. This
    resulted in out-of-bounds mem acceess when eap_identity_prefix was used
    by proto_tree_add_string_format().

    ==14744== Conditional jump or move depends on uninitialised value(s)
    ==14744==    at 0x4C294F8: strlen (mc_replace_strmem.c:390)
    ==14744==    by 0xC19C97F: g_strdup (gstrfuncs.c:355)
    ==14744==    by 0x739CA75: string_fvalue_set_string (ftype-string.c:51)
    ==14744==    by 0x67136A9: proto_tree_add_string (proto.c:3515)
    ==14744==    by 0x6713870: proto_tree_add_string_format (proto.c:3547)
    ==14744==    by 0x69BB494: dissect_eap (packet-eap.c:838)
    ==14744==    by 0x66FD0B4: call_dissector_work (packet.c:649)

    As the content is a number anyway, the simplest solution is to make
    eap_identity_prefix a numeric item and use
    proto_tree_add_uint_format_value().

    Bug: 12913
    Change-Id: I907b1d3555a96e9662b1d8253d17d35adfdada48
    Reviewed-on: https://code.wireshark.org/review/17760
    Reviewed-by: Guy Harris <guy@alum.mit.edu>


=================================================================
==7255==ERROR: AddressSanitizer: global-buffer-overflow on address
0x7fe65ce86646 at pc 0x0000004947dd bp 0x7fffdf4cfdb0 sp 0x7fffdf4cf560
READ of size 7 at 0x7fe65ce86646 thread T0
    #0 0x4947dc 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark+0x4947dc)
    #1 0x7fe65b573a3d 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x7c03a3d)
    #2 0x7fe65b569b35 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x7bf9b35)
    #3 0x7fe65b2638bc 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f38bc)
    #4 0x7fe65b26172c 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f172c)
    #5 0x7fe65b52c996 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x7bbc996)
    #6 0x7fe65b2638bc 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f38bc)
    #7 0x7fe65b26358a 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f358a)
    #8 0x7fe65b8fe651 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x7f8e651)
    #9 0x7fe65b2638bc 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f38bc)
    #10 0x7fe65b26358a 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f358a)
    #11 0x7fe65b4c3ac9 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x7b53ac9)
    #12 0x7fe65b2638bc 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f38bc)
    #13 0x7fe65b26358a 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f358a)
    #14 0x7fe65b80f6cf 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x7e9f6cf)
    #15 0x7fe65b2638bc 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f38bc)
    #16 0x7fe65b26172c 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f172c)
    #17 0x7fe65b260efa 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78f0efa)
    #18 0x7fe65b2470ee 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/lib/libwireshark.so.0+0x78d70ee)
    #19 0x50ea04 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark+0x50ea04)
    #20 0x5090d5 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark+0x5090d5)
    #21 0x7fe65122882f  (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #22 0x423328 
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark+0x423328)

0x7fe65ce86646 is located 58 bytes to the left of global variable '<string
literal>' defined in 'packet-bluetooth.c:106:17' (0x7fe65ce86680) of size 42
  '<string literal>' is ascii string 'Service Discovery Server Service Class
ID'
0x7fe65ce86646 is located 0 bytes to the right of global variable '<string
literal>' defined in 'packet-bluetooth.c:104:17' (0x7fe65ce86640) of size 6
  '<string literal>' is ascii string 'L2CAP'
SUMMARY: AddressSanitizer: global-buffer-overflow
(/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark+0x4947dc) 
Shadow bytes around the buggy address:
  0x0ffd4b9c8c70: 05 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
  0x0ffd4b9c8c80: 00 00 00 01 f9 f9 f9 f9 00 00 06 f9 f9 f9 f9 f9
  0x0ffd4b9c8c90: 00 00 06 f9 f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9
  0x0ffd4b9c8ca0: 06 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9
  0x0ffd4b9c8cb0: 00 04 f9 f9 f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9
=>0x0ffd4b9c8cc0: 00 00 02 f9 f9 f9 f9 f9[06]f9 f9 f9 f9 f9 f9 f9
  0x0ffd4b9c8cd0: 00 00 00 00 00 02 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0ffd4b9c8ce0: 00 01 f9 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9
  0x0ffd4b9c8cf0: 00 04 f9 f9 f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9
  0x0ffd4b9c8d00: 00 00 02 f9 f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9
  0x0ffd4b9c8d10: 00 00 01 f9 f9 f9 f9 f9 00 00 03 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==7255==ABORTING

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.