Bug #43
closedProcessing the attached pcap causes abort in StreamMsgFree at exit.
Description
coz@coz-desktop:~/downloads/suricatafuzz1$ gdb src/suricata core
GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying" 
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/coz/downloads/suricatafuzz1/src/suricata...done.
warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libhtp-0.1.so.1...done.
Loaded symbols for /usr/lib/libhtp-0.1.so.1
Reading symbols from /usr/lib/libpcap.so.0.8...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpcap.so.0.8
Reading symbols from /usr/local/lib/libpfring.so...done.
Loaded symbols for /usr/local/lib/libpfring.so
Reading symbols from /usr/lib/libnet.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libnet.so.1
Reading symbols from /lib/libpthread.so.0...Reading symbols from /usr/lib/debug/lib/libpthread-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /usr/lib/libyaml-0.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libyaml-0.so.1
Reading symbols from /lib/libpcre.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libpcre.so.3
Reading symbols from /lib/libc.so.6...Reading symbols from /usr/lib/debug/lib/libc-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/lib/ld-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcc_s.so.1
Core was generated by `src/suricata c ../suricata117.yaml -r ./defconctf-segv-7890-3.pcap -l ./'.
Program terminated with signal 6, Aborted.
#0  0x00007fecab5364b5 in *GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64    ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
    in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt full
#0  0x00007fecab5364b5 in *_GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        pid = <value optimized out>
        selftid = <value optimized out>
#1  0x00007fecab539f50 in *_GI_abort () at abort.c:92
        act = {__sigaction_handler = {sa_handler = 0x300000009, sa_sigaction = 0x300000009}, sa_mask = {__val = {140735516351328, 140735516351184, 140735516351376, 140735516362242, 12, 140654464437503, 3, 140735516351386, 6, 
              140654464437507, 2, 140735516351374, 2, 140654464428625, 1, 140654464437503}}, sa_flags = 3, sa_restorer = 0x7fff8a759b94}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007fecab56ec97 in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
        ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff8a75a500, reg_save_area = 0x7fff8a75a410}}
        ap_copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff8a75a500, reg_save_area = 0x7fff8a75a410}}
        fd = 3
        on_2 = <value optimized out>
        list = <value optimized out>
        nlist = 1024
        cp = <value optimized out>
        written = false
#3  0x00007fecab578dd6 in malloc_printerr (action=3, str=0x7fecab63a638 "munmap_chunk(): invalid pointer", ptr=<value optimized out>) at malloc.c:6217
        buf = "0000000002eade30" 
        cp = 0x0
#4  0x0000000000478871 in StreamMsgFree (ptr=0x2eade30) at stream.c:44
        s = 0x2eade30
#5  0x0000000000463919 in PoolFree (p=0x2e74b20) at util-pool.c:77
        pb = 0x2e9aad0
#6  0x0000000000478bae in StreamMsgQueuesDeinit (quiet=0 '\000') at stream.c:151
No locals.
#7  0x000000000047e0dc in StreamTcpReassembleFree (quiet=0 '\000') at stream-tcp-reassemble.c:174
        u16 = 8
#8  0x00000000004791e6 in StreamTcpFreeConfig (quiet=0 '\000') at stream-tcp.c:270
        __FUNCTION = "StreamTcpFreeConfig" 
#9  0x0000000000405558 in main (argc=7, argv=0x7fff8a75b1c8) at suricata.c:749
        opt = -1
        mode = 2
        pcap_file = 0x7fff8a75c629 "./defconctf-segv-7890-3.pcap" 
        pcap_dev = 0x0
        pfring_dev = 0x0
        sig_file = 0x0
        nfq_id = 0
        conf_filename = 0x7fff8a75c612 "../suricata117.yaml" 
        dump_config = 0
        list_unittests = 0
        daemon = 0
        log_dir = 0x171f1a0 "./" 
        buf = {st_dev = 2055, st_ino = 16679048, st_nlink = 7, st_mode = 16877, st_uid = 1000, st_gid = 1000, pad0 = 0, st_rdev = 0, st_size = 12288, st_blksize = 4096, st_blocks = 24, st_atim = {tv_sec = 1262645653, tv_nsec = 0}, 
          st_mtim = {tv_sec = 1262644882, tv_nsec = 0}, st_ctim = {tv_sec = 1262644882, tv_nsec = 0}, __unused = {0, 0, 0}}
        long_opts = {{name = 0x49de08 "dump-config", has_arg = 0, flag = 0x7fff8a75ac9c, val = 1}, {name = 0x49de14 "pfring-int", has_arg = 1, flag = 0x0, val = 0}, {name = 0x49de1f "pfring-clusterid", has_arg = 1, flag = 0x0, 
            val = 0}, {name = 0x49de30 "unittest-filter", has_arg = 1, flag = 0x0, val = 85}, {name = 0x49de40 "list-unittests", has_arg = 0, flag = 0x7fff8a75ac98, val = 1}, {name = 0x49de4f "init-errors-fatal", has_arg = 0, 
            flag = 0x0, val = 0}, {name = 0x49de61 "fatal-unittests", has_arg = 0, flag = 0x0, val = 0}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
        option_index = 0
        short_opts = "c:Dhi:l:q:r:us:U:V" 
        __FUNCTION = "main" 
        c = 255 '\377'
        i = 50
        de_ctx = 0x1e0ffa0
        af_logfile_ctx = 0x20504c0
        ad_logfile_ctx = 0x2050510
        lh_logfile_ctx = 0x2050560
---Type <return> to continue, or q <return> to quit--
        aul_logfile_ctx = 0x20505d0
        aua_logfile_ctx = 0x2050620
        au2a_logfile_ctx = 0x2050670
        start_time = {tv_sec = 1262646002, tv_usec = 557201}
Files
Updated by Gurvinder Singh almost 16 years ago
- File 0001-bug-41-patch.patch 0001-bug-41-patch.patch added
 - Status changed from New to Resolved
 
The issue was due to not updating the stream->last_ack in the TCP closewait state. This was causing wrong payload_len in StreamTcpReassembleHandleSegmentUpdateACK(). The patch seems to fix the issue, as there is no segv after running with given pcap.
Updated by Gurvinder Singh almost 16 years ago
- Status changed from Resolved to Closed
 
patch applied!!