Project

General

Profile

Actions

Bug #61

closed

Processing the attached pcap causes the engine to hang inside of SMBParseByteCount

Added by Will Metcalf over 14 years ago. Updated about 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

ulimit -c unlimited; src/suricata -c suricata.yaml -r ./sandnet.pcap-fuzz-2010-01-16-00-31-24-1 -l ./

(gdb) bt full
#0 SMBParseByteCount (f=0x2772d20, smb_state=0x299c540, pstate=0x2bda018,
input=0x7fe438d5c6d3 "\002PC NETWORK PROGRAM 1.0", input_len=98,
output=0x7fe440938a40) at app-layer-smb.c:698
sstate = 0x299c540
p = 0x7fe438d5c6d3 "\002PC NETWORK PROGRAM 1.0"
retval = 0
parsed = 0
#1 0x000000000049f900 in SMBParse (f=0x2772d20, smb_state=0x299c540,
pstate=0x2bda018, input=0x7fe438d5c6ac "", input_len=98,
output=0x7fe440938a40) at app-layer-smb.c:1032
sstate = 0x299c540
retval = 0
parsed = 39
#2 0x0000000000498b67 in AppLayerDoParse (f=0x2772d20,
app_layer_state=0x299c540, parser_state=0x2bda018,
input=0x7fe438d5c6ac "", input_len=137, parser_idx=9, proto=10,
need_lock=0 '\000') at app-layer-parser.c:611
retval = 0
result = {head = 0x0, tail = 0x0, cnt = 0}
r = 0
PRETTY_FUNCTION = "AppLayerDoParse"
e = 0x7fffbf9a1820
#3 0x0000000000499190 in AppLayerParse (f=0x2772d20, proto=10 '\n',
---Type <return> to continue, or q <return> to quit---
flags=5 '\005', input=0x7fe438d5c6ac "", input_len=137, need_lock=0 '\000')
at app-layer-parser.c:777
parser_idx = 9
p = 0x6f1520
ssn = 0x7fe438d0fd00
parser_state_store = 0x2bda000
parser_state = 0x2bda018
app_layer_state = 0x299c540
r = 1109126720
FUNCTION = "AppLayerParse"
#4 0x0000000000495b47 in AppLayerHandleMsg (dp_ctx=0x29c1f18,
smsg=0x7fe438d5c670, need_lock=0 '\000') at app-layer-detect-proto.c:360
alproto = 10
r = 0
ssn = 0x7fe438d0fd00
#5 0x000000000048a215 in StreamTcpReassembleProcessAppLayer (ra_ctx=0x29c1f10)
at stream-tcp-reassemble.c:1510
smsg = 0x7fe438d5c670
r = 0
#6 0x00000000004856b0 in StreamTcpPacket (tv=0x29c15e0, p=0x2306af0,
stt=0x2ce91e0) at stream-tcp.c:2407
ssn = 0x7fe438d0fd00
#7 0x000000000048574a in StreamTcp (tv=0x29c15e0, p=0x2306af0,
---Type <return> to continue, or q <return> to quit---
data=0x2ce91e0, pq=0x29c16e0) at stream-tcp.c:2425
stt = 0x2ce91e0
ret = TM_ECODE_OK
#8 0x0000000000477438 in TmThreadsSlot1 (td=0x29c15e0) at tm-threads.c:325
tv = 0x29c15e0
s = 0x29c16b0
p = 0x2306af0
run = 1 '\001'
r = TM_ECODE_OK
#9 0x00007fe442618a04 in start_thread (arg=<value optimized out>)
at pthread_create.c:300
__res = <value optimized out>
pd = 0x7fe440939910
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140618312685840,
-773579082521263802, 140736407935008, 0, 0, 3,
759754612432814406, 759759439718891846}, mask_was_saved = 0}},
priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0,
cleanup = 0x0, canceltype = 0}}}
not_first_call = <value optimized out>
robust = <value optimized out>
#10 0x00007fe441f3380d in clone ()
at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112


Files

sandnet.pcap-fuzz-2010-01-16-00-31-24-1 (22.2 KB) sandnet.pcap-fuzz-2010-01-16-00-31-24-1 pcap causes the engine to hang inside of SMBParseByteCount Will Metcalf, 01/18/2010 06:53 AM
0001-fix-bug-61.patch (26.8 KB) 0001-fix-bug-61.patch fix for bug 61 Kirby Kuehl, 01/18/2010 01:44 PM
Actions #1

Updated by Kirby Kuehl over 14 years ago

Protect code from invalid values from SMB and DCERPC packets to prevent infinite loops.

Actions #2

Updated by Kirby Kuehl over 14 years ago

  • % Done changed from 0 to 90
  • Estimated time changed from 2.50 h to 1.00 h
Actions #3

Updated by Victor Julien about 14 years ago

  • Status changed from New to Closed
Actions

Also available in: Atom PDF