Bug #1706: smtp memory leaks - Suricata - Open Information Security Foundation

Custom queries

8.0.0 Stories
Good First Issues
OISF community
Open Doc tasks

Actions

Copy link

Bug #1706

closed

VJ EL

smtp memory leaks

Bug #1706: smtp memory leaks

Added by Victor Julien about 10 years ago. Updated about 10 years ago.

Status:

Closed

Priority:

High

Assignee:

Eric Leblond

Target version:

3.0.1RC1

Affected Versions:

Effort:

Difficulty:

Label:

History
Notes
Property changes

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#1

Direct leak of 9982880 byte(s) in 2902 object(s) allocated from:
    #0 0x4c253b in malloc ??:?
    #1 0x10c39ac in MimeDecInitParser /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/util-decode-mime.c:2379
    #2 0x6a0f91 in SMTPProcessRequest /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1085
    #3 0x697658 in SMTPParse /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1185
    #4 0x68fa7a in SMTPParseClientRecord /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1208
    #5 0x6561c5 in AppLayerParserParse /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-parser.c:908
    #6 0x53dc2e in AppLayerHandleTCPData /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer.c:444
    #7 0xf8e0af in DoReassemble /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:2635
    #8 0xf8c3f8 in StreamTcpReassembleAppLayer /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3028
    #9 0xf94267 in StreamTcpReassembleHandleSegmentUpdateACK /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3404
    #10 0xf9643d in StreamTcpReassembleHandleSegment /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3432
    #11 0xf578b4 in HandleEstablishedPacketToClient /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:2245
    #12 0xeea3c7 in StreamTcpPacketStateEstablished /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:2489
    #13 0xec1d38 in StreamTcpPacket /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:4568
    #14 0xeb0e16 in StreamTcp /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:5064
    #15 0xff52a4 in TmThreadsSlotVarRun /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/tm-threads.c:130
    #16 0xffdad1 in TmThreadsSlotVar /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/tm-threads.c:474
    #17 0x7f7cd678d181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312 (discriminator 2)

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#2

Direct leak of 300372 byte(s) in 10640 object(s) allocated from:
    #0 0x4c253b in malloc ??:?
    #1 0x6ab89d in SMTPParseCommandWithParam /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:996
    #2 0x6a6914 in SMTPParseCommandMAILFROM /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1013
    #3 0x6a1f95 in SMTPProcessRequest /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1121
    #4 0x697658 in SMTPParse /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1185
    #5 0x68fa7a in SMTPParseClientRecord /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1208
    #6 0x6561c5 in AppLayerParserParse /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-parser.c:908
    #7 0x53dc2e in AppLayerHandleTCPData /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer.c:444
    #8 0xf8e0af in DoReassemble /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:2635
    #9 0xf8c3f8 in StreamTcpReassembleAppLayer /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3028
    #10 0xf94267 in StreamTcpReassembleHandleSegmentUpdateACK /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3404
    #11 0xf9643d in StreamTcpReassembleHandleSegment /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3432
    #12 0xf578b4 in HandleEstablishedPacketToClient /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:2245
    #13 0xeea3c7 in StreamTcpPacketStateEstablished /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:2489
    #14 0xec1d38 in StreamTcpPacket /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:4568
    #15 0xeb0e16 in StreamTcp /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:5064
    #16 0xff52a4 in TmThreadsSlotVarRun /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/tm-threads.c:130
    #17 0xffdad1 in TmThreadsSlotVar /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/tm-threads.c:474
    #18 0x7f7cd678d181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312 (discriminator 2)

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#3

Similar to the MAILFROM one above:

Direct leak of 15015 byte(s) in 621 object(s) allocated from:
    #0 0x4c253b in malloc ??:?
    #1 0x6ab89d in SMTPParseCommandWithParam /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:996
    #2 0x6a6722 in SMTPParseCommandHELO /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1008
    #3 0x6a1cae in SMTPProcessRequest /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1114
    #4 0x697658 in SMTPParse /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1185
    #5 0x68fa7a in SMTPParseClientRecord /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1208
    #6 0x6561c5 in AppLayerParserParse /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-parser.c:908
    #7 0x539e48 in AppLayerHandleTCPData /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer.c:277
    #8 0xf8cb7d in StreamTcpReassembleAppLayer /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3053
    #9 0xf94267 in StreamTcpReassembleHandleSegmentUpdateACK /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3404
    #10 0xf9643d in StreamTcpReassembleHandleSegment /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3432
    #11 0xf578b4 in HandleEstablishedPacketToClient /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:2245
    #12 0xeea3c7 in StreamTcpPacketStateEstablished /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:2489
    #13 0xec1d38 in StreamTcpPacket /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:4568
    #14 0xeb0e16 in StreamTcp /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:5064
    #15 0xff52a4 in TmThreadsSlotVarRun /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/tm-threads.c:130
    #16 0xffdad1 in TmThreadsSlotVar /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/tm-threads.c:474
    #17 0x7f7cd678d181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312 (discriminator 2)

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#4

In all cases the issue seems to be that the existing pointer is simply overwritten. So it seems no checks are done to make sure that this doesn't happen.

EL Updated by Eric Leblond about 10 years ago Actions
Copy link
#5

% Done changed from 0 to 80

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#6

Status changed from Assigned to Closed
% Done changed from 80 to 100

https://github.com/inliniac/suricata/pull/1892

Actions

Copy link

Also available in: PDF Atom

Project

General

Profile

Suricata

Custom queries

Bug #1706

smtp memory leaks

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#1

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#2

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#3

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#4

EL Updated by Eric Leblond about 10 years ago Actions
Copy link
#5

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#6

Project

General

Profile

Suricata

Custom queries

Bug #1706

smtp memory leaks

VJ Updated by Victor Julien about 10 years ago ActionsCopy link #1

VJ Updated by Victor Julien about 10 years ago ActionsCopy link #2

VJ Updated by Victor Julien about 10 years ago ActionsCopy link #3

VJ Updated by Victor Julien about 10 years ago ActionsCopy link #4

EL Updated by Eric Leblond about 10 years ago ActionsCopy link #5

VJ Updated by Victor Julien about 10 years ago ActionsCopy link #6

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#1

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#2

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#3

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#4

EL Updated by Eric Leblond about 10 years ago Actions
Copy link
#5

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
#6