Actions
Bug #6294
closedhttp2/brotli: subtract with overflow found by sydr-Fuzz
Affected Versions:
Effort:
Difficulty:
Label:
Hardening
Description
Stacktrace:
"#0 0x00007ffff79ec00b in raise () from /lib/x86_64-linux-gnu/libc.so.6", "#1 0x00007ffff79cb859 in abort () from /lib/x86_64-linux-gnu/libc.so.6", "#2 0x0000000000f140e7 in std::sys::unix::abort_internal () at /rustc/8ede3aae28fe6e4d52b38157d7bfe0d3bceef225/library/std/src/sys/unix/mod.rs:359", "#3 0x0000000000f088c9 in std::panicking::rust_panic () at /rustc/8ede3aae28fe6e4d52b38157d7bfe0d3bceef225/library/std/src/panicking.rs:756", "#4 0x0000000000f086f1 in std::panicking::rust_panic_with_hook () at /rustc/8ede3aae28fe6e4d52b38157d7bfe0d3bceef225/library/std/src/panicking.rs:727", "#5 0x0000000000f08401 in std::panicking::begin_panic_handler::{closure#0} () at /rustc/8ede3aae28fe6e4d52b38157d7bfe0d3bceef225/library/std/src/panicking.rs:595", "#6 0x0000000000f058c6 in std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::{closure_env#0}, !> () at /rustc/8ede3aae28fe6e4d52b38157d7bfe0d3bceef225/library/std/src/sys_common/backtrace.rs:151", "#7 0x0000000000f08192 in std::panicking::begin_panic_handler () at /rustc/8ede3aae28fe6e4d52b38157d7bfe0d3bceef225/library/std/src/panicking.rs:593", "#8 0x0000000000f60c93 in core::panicking::panic_fmt () at /rustc/8ede3aae28fe6e4d52b38157d7bfe0d3bceef225/library/core/src/panicking.rs:67", "#9 0x0000000000f60d23 in core::panicking::panic () at /rustc/8ede3aae28fe6e4d52b38157d7bfe0d3bceef225/library/core/src/panicking.rs:117", "#10 0x00000000008079d2 in brotli_decompressor::decode::ProcessCommandsInternal<alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc> (safe=false, s=0x61e0000018d0, input=...) at /suricata/rust/vendor/brotli-decompressor/src/bit_reader/mod.rs:151", "#11 0x0000000000a865a5 in brotli_decompressor::decode::ProcessCommands<alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc> (s=0x61e0000018d0, input=...) at /suricata/rust/vendor/brotli-decompressor/src/decode.rs:2616", "#12 brotli_decompressor::decode::BrotliDecompressStream<alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc> (input_offset=0x61e0000018b8, xinput=..., available_out=<optimized out>, output_offset=<optimized out>, output=..., total_out=0x61e0000018b0, s=0x61e0000018d0, available_in=<optimized out>) at /suricata/rust/vendor/brotli-decompressor/src/decode.rs:3151", "#13 brotli_decompressor::reader::{impl#5}::read<std::io::error::Error, brotli_decompressor::io_wrappers::IntoIoReader<suricata::http2::decompression::HTTP2cursor>, alloc_stdlib::heap_alloc::WrapBox<u8>, alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc> (self=0x61e000001880, buf=...) at /suricata/rust/vendor/brotli-decompressor/src/reader.rs:283", "#14 brotli_decompressor::reader::{impl#1}::read<suricata::http2::decompression::HTTP2cursor, alloc_stdlib::heap_alloc::WrapBox<u8>, alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc, alloc_stdlib::std_alloc::StandardAlloc> (self=0x61e000001880, buf=...) at /suricata/rust/vendor/brotli-decompressor/src/reader.rs:85", "#15 brotli_decompressor::reader::{impl#3}::read<suricata::http2::decompression::HTTP2cursor> (self=0x61e000001880, buf=...) at /suricata/rust/vendor/brotli-decompressor/src/reader.rs:178", "#16 suricata::http2::decompression::http2_decompress<brotli_decompressor::reader::Decompressor<suricata::http2::decompression::HTTP2cursor>> (decoder=0x61e000001880, input=..., output=0x7fffffffdfe8) at /suricata/rust/src/http2/decompression.rs:145", "#17 0x0000000000a9cf3d in suricata::http2::decompression::HTTP2DecoderHalf::decompress (self=0x620000000a30, input=..., output=0x7fffffffdfe8) at /suricata/rust/src/http2/decompression.rs:209", "#18 0x0000000000a9cf3d in suricata::http2::decompression::HTTP2Decoder::decompress (input=..., output=0x7fffffffdfe8, dir=suricata::core::Direction::ToClient, self=<optimized out>)", "#19 suricata::http2::http2::HTTP2Transaction::decompress (input=..., dir=suricata::core::Direction::ToClient, sfcm=0x2af6b40 <sfc>, self=<optimized out>, over=<optimized out>, flow=<optimized out>) at /suricata/rust/src/http2/http2.rs:222", "#20 suricata::http2::http2::HTTP2State::parse_frames (self=0x60e00003dd00, input=..., il=584, dir=suricata::core::Direction::ToClient, flow=<optimized out>) at /suricata/rust/src/http2/http2.rs:982", "#21 0x0000000000aa2a29 in suricata::http2::http2::HTTP2State::parse_tc (self=0x60e00003dd00, input=..., flow=0x6120003b2cc0) at /suricata/rust/src/http2/http2.rs:1077", "#22 suricata::http2::http2::rs_http2_parse_tc (flow=0x6120003b2cc0, state=0x60e00003dd00, _pstate=<optimized out>, stream_slice=..., _data=<optimized out>) at /suricata/rust/src/http2/http2.rs:1170", "#23 0x0000000000fa0988 in AppLayerParserParse (tv=<optimized out>, alp_tctx=<optimized out>, f=0x6120003b2cc0, alproto=<optimized out>, flags=<optimized out>, input=<optimized out>, input_len=<optimized out>) at /suricata/src/app-layer-parser.c:1403", "#24 0x0000000000f887ac in LLVMFuzzerTestOneInput (data=<optimized out>, size=<optimized out>) at /suricata/src/tests/fuzz/fuzz_applayerparserparse.c:161", "#25 0x00000000007fd7fe in ExecuteFilesOnyByOne (argc=2, argv=0x7fffffffe948, callback=callback@entry=0xf87330 <LLVMFuzzerTestOneInput>) at /AFLplusplus/utils/aflpp_driver/aflpp_driver.c:255", "#26 0x00000000007fd609 in LLVMFuzzerRunDriver (argcp=argcp@entry=0x7fffffffe844, argvp=argvp@entry=0x7fffffffe848, callback=0xf87330 <LLVMFuzzerTestOneInput>) at /AFLplusplus/utils/aflpp_driver/aflpp_driver.c:364", "#27 0x00000000007fd1c9 in main (argc=2, argv=0x7fffffffe948) at /AFLplusplus/utils/aflpp_driver/aflpp_driver.c:300"
Files
Updated by Alexey Simakov over 1 year ago
- File crash-414aaa3d0b1f2b64c05db5abd223bb5b12d83869 crash-414aaa3d0b1f2b64c05db5abd223bb5b12d83869 added
- Affected Versions 7.0.0 added
Applying additional information
fuzz target -fuzz_applayerparserparse_http2
Updated by Philippe Antoine about 1 year ago
- Status changed from New to In Review
- Target version changed from TBD to 7.0.3
https://github.com/OISF/suricata/pull/9752 should fix this
Updated by Victor Julien about 1 year ago
- Status changed from In Review to Feedback
- Assignee changed from OISF Dev to Alexey Simakov
Alexey can you confirm is the issue in solved in our git master branch?
Updated by Alexey Simakov about 1 year ago
Sorry for delay, need some time to check this
Updated by Victor Julien about 1 year ago
- Subject changed from Subtract with overflow found by sydr-Fuzz to http2/brotli: subtract with overflow found by sydr-Fuzz
- Status changed from Feedback to Closed
- Assignee changed from Alexey Simakov to Philippe Antoine
Thanks Alexey!
Actions