Bug #5443: ftp-data: failed assertion - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5443

closed

PA VJ

ftp-data: failed assertion

Bug #5443: ftp-data: failed assertion

Added by Philippe Antoine almost 4 years ago. Updated over 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

7.0.1

Affected Versions:

Effort:

Difficulty:

Label:

Description

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49010

./src/suricata -k none -c suricata.yaml --set stream.midstream=true --runmode=single -r lol.pcap

Victor, is this assertion really meant to be unreachable ?

Files

lol.pcap (4.13 KB) lol.pcap

Philippe Antoine, 07/15/2022 01:46 PM

Related issues 1 (0 open — 1 closed)

PA Updated by Philippe Antoine almost 4 years ago Actions
Copy link
#1

Bug introduced by commit https://github.com/OISF/suricata/commit/07bf9214513e54e04508c055bb8ed29aa3bce60f

PA Updated by Philippe Antoine almost 4 years ago Actions
Copy link
#2

Related to Bug #5205: FTP-data unrecognized depending on multi-threading added

PA Updated by Philippe Antoine almost 4 years ago Actions
Copy link
#3

Took me some time to figure out that I was needing --runmode=single to reproduce due to #5205 (fuzz target runs in single thread and so ftp-data detection goes alright)

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
#4

Status changed from New to Assigned
Priority changed from Normal to High

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
#5

My analysis :
- we have a FTP flow which expects a ftp-data flow
- we use stream.midstream=true
- the ftp-data flow has a first packet with data
- the ftp-data flow has then a second packet in same direction with RST flag (and no ACK flag)
- RST triggers the parse of all available data, even if it has never been acked

Should we process any of these data that has never been acked ?

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
#6

Target version changed from 7.0.0-beta1 to 8.0.0-beta1

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
#7

Why not 7.0.rc1 ?

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
#8

Target version changed from 8.0.0-beta1 to 7.0.0-rc1

Accident during mass retargeting, thanks for catching this.

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
#9

I would disable the debug assertion if we cannot have a better fix quickly.
This would allow to have fuzzing going on and we would still have the issue to investigate...