Project

General

Profile

Actions

Bug #43

closed

Processing the attached pcap causes abort in StreamMsgFree at exit.

Added by Will Metcalf about 14 years ago. Updated about 14 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

coz@coz-desktop:~/downloads/suricatafuzz1$ gdb src/suricata core
GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/&gt;...
Reading symbols from /home/coz/downloads/suricatafuzz1/src/suricata...done.

warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libhtp-0.1.so.1...done.
Loaded symbols for /usr/lib/libhtp-0.1.so.1
Reading symbols from /usr/lib/libpcap.so.0.8...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpcap.so.0.8
Reading symbols from /usr/local/lib/libpfring.so...done.
Loaded symbols for /usr/local/lib/libpfring.so
Reading symbols from /usr/lib/libnet.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libnet.so.1
Reading symbols from /lib/libpthread.so.0...Reading symbols from /usr/lib/debug/lib/libpthread-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /usr/lib/libyaml-0.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libyaml-0.so.1
Reading symbols from /lib/libpcre.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libpcre.so.3
Reading symbols from /lib/libc.so.6...Reading symbols from /usr/lib/debug/lib/libc-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/lib/ld-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcc_s.so.1
Core was generated by `src/suricata c ../suricata117.yaml -r ./defconctf-segv-7890-3.pcap -l ./'.
Program terminated with signal 6, Aborted.
#0 0x00007fecab5364b5 in *GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt full
#0 0x00007fecab5364b5 in *_GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
pid = <value optimized out>
selftid = <value optimized out>
#1 0x00007fecab539f50 in *
_GI_abort () at abort.c:92
act = {__sigaction_handler = {sa_handler = 0x300000009, sa_sigaction = 0x300000009}, sa_mask = {__val = {140735516351328, 140735516351184, 140735516351376, 140735516362242, 12, 140654464437503, 3, 140735516351386, 6,
140654464437507, 2, 140735516351374, 2, 140654464428625, 1, 140654464437503}}, sa_flags = 3, sa_restorer = 0x7fff8a759b94}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007fecab56ec97 in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff8a75a500, reg_save_area = 0x7fff8a75a410}}
ap_copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff8a75a500, reg_save_area = 0x7fff8a75a410}}
fd = 3
on_2 = <value optimized out>
list = <value optimized out>
nlist = 1024
cp = <value optimized out>
written = false
#3 0x00007fecab578dd6 in malloc_printerr (action=3, str=0x7fecab63a638 "munmap_chunk(): invalid pointer", ptr=<value optimized out>) at malloc.c:6217
buf = "0000000002eade30"
cp = 0x0
#4 0x0000000000478871 in StreamMsgFree (ptr=0x2eade30) at stream.c:44
s = 0x2eade30
#5 0x0000000000463919 in PoolFree (p=0x2e74b20) at util-pool.c:77
pb = 0x2e9aad0
#6 0x0000000000478bae in StreamMsgQueuesDeinit (quiet=0 '\000') at stream.c:151
No locals.
#7 0x000000000047e0dc in StreamTcpReassembleFree (quiet=0 '\000') at stream-tcp-reassemble.c:174
u16 = 8
#8 0x00000000004791e6 in StreamTcpFreeConfig (quiet=0 '\000') at stream-tcp.c:270
__FUNCTION
= "StreamTcpFreeConfig"
#9 0x0000000000405558 in main (argc=7, argv=0x7fff8a75b1c8) at suricata.c:749
opt = -1
mode = 2
pcap_file = 0x7fff8a75c629 "./defconctf-segv-7890-3.pcap"
pcap_dev = 0x0
pfring_dev = 0x0
sig_file = 0x0
nfq_id = 0
conf_filename = 0x7fff8a75c612 "../suricata117.yaml"
dump_config = 0
list_unittests = 0
daemon = 0
log_dir = 0x171f1a0 "./"
buf = {st_dev = 2055, st_ino = 16679048, st_nlink = 7, st_mode = 16877, st_uid = 1000, st_gid = 1000, pad0 = 0, st_rdev = 0, st_size = 12288, st_blksize = 4096, st_blocks = 24, st_atim = {tv_sec = 1262645653, tv_nsec = 0},
st_mtim = {tv_sec = 1262644882, tv_nsec = 0}, st_ctim = {tv_sec = 1262644882, tv_nsec = 0}, __unused = {0, 0, 0}}
long_opts = {{name = 0x49de08 "dump-config", has_arg = 0, flag = 0x7fff8a75ac9c, val = 1}, {name = 0x49de14 "pfring-int", has_arg = 1, flag = 0x0, val = 0}, {name = 0x49de1f "pfring-clusterid", has_arg = 1, flag = 0x0,
val = 0}, {name = 0x49de30 "unittest-filter", has_arg = 1, flag = 0x0, val = 85}, {name = 0x49de40 "list-unittests", has_arg = 0, flag = 0x7fff8a75ac98, val = 1}, {name = 0x49de4f "init-errors-fatal", has_arg = 0,
flag = 0x0, val = 0}, {name = 0x49de61 "fatal-unittests", has_arg = 0, flag = 0x0, val = 0}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
option_index = 0
short_opts = "c:Dhi:l:q:r:us:U:V"
__FUNCTION
= "main"
c = 255 '\377'
i = 50
de_ctx = 0x1e0ffa0
af_logfile_ctx = 0x20504c0
ad_logfile_ctx = 0x2050510
lh_logfile_ctx = 0x2050560
---Type <return> to continue, or q <return> to quit--

aul_logfile_ctx = 0x20505d0
aua_logfile_ctx = 0x2050620
au2a_logfile_ctx = 0x2050670
start_time = {tv_sec = 1262646002, tv_usec = 557201}


Files

defconctf-segv-7890-3.pcap.gz (2.5 MB) defconctf-segv-7890-3.pcap.gz defcon17ctf fuzzed pcap abort in StreamMsgFree at exit Will Metcalf, 01/04/2010 04:49 PM
defcon-segv-7890-3-vg.log (18.7 KB) defcon-segv-7890-3-vg.log valgrind memcheck output Will Metcalf, 01/04/2010 04:49 PM
0001-bug-41-patch.patch (12.5 KB) 0001-bug-41-patch.patch Gurvinder Singh, 01/06/2010 09:10 AM
Actions #1

Updated by Gurvinder Singh about 14 years ago

The issue was due to not updating the stream->last_ack in the TCP closewait state. This was causing wrong payload_len in StreamTcpReassembleHandleSegmentUpdateACK(). The patch seems to fix the issue, as there is no segv after running with given pcap.

Actions #2

Updated by Gurvinder Singh about 14 years ago

  • Status changed from Resolved to Closed

patch applied!!

Actions

Also available in: Atom PDF