Project

General

Profile

Actions
Copy link

Bug #8353

open
SZ OD

Underflow in TmqhOutputPacketpool when calculating "outstanding"

Bug #8353: Underflow in TmqhOutputPacketpool when calculating "outstanding"

Added by Sergey Zhidkih 5 months ago. Updated 16 days ago.

Status:
Triaged
Priority:
Normal
Assignee:
OISF Dev
Target version:
9.0.0-beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

Fuzzer discovered case when "outstanding" become negative and thus underflows. Not sure if it's an actual bug by itself but since outstanding is unsigned integer it may point to some problem.

Attaching fuzzer backtrace and case.

Files

Download all files
id_009616,time_0,execs_0,orig_ef6aaab27806c44e179464cc3cd35672aa381b86.log (3.41 KB) id_009616,time_0,execs_0,orig_ef6aaab27806c44e179464cc3cd35672aa381b86.log log Sergey Zhidkih, 03/06/2026 03:20 PM
id_009616,time_0,execs_0,orig_ef6aaab27806c44e179464cc3cd35672aa381b86 (647 Bytes) id_009616,time_0,execs_0,orig_ef6aaab27806c44e179464cc3cd35672aa381b86 case Sergey Zhidkih, 03/06/2026 03:20 PM

PA Updated by Philippe Antoine 16 days ago Actions
Copy link
 #1

  • Status changed from New to Feedback
  • Assignee set to Sergey Zhidkih

Which fuzz target did you use ? With which sanitizer and options ?

SZ Updated by Sergey Zhidkih 16 days ago Actions
Copy link
 #2

Philippe Antoine wrote in #note-1:

Which fuzz target did you use ? With which sanitizer and options ?

fuzz_decodepcapfile.

    export CLANG_SANITIZERS="                   \
        -fsanitize=undefined                    \
        -fsanitize=float-divide-by-zero         \
        -fsanitize=integer                      \
        -fsanitize=implicit-conversion          \
        -fsanitize=local-bounds                 \
        -fsanitize=nullability                  \
        -fsanitize=vptr                         \
        -fsanitize=address                      \
        -fsanitize=alignment                    \
        " 


./configure \
    --enable-fuzztargets \
    --with-libpcre-includes=/usr/include/pcre \
    --enable-gccprotect \
    --enable-pie \
    --disable-gccmarch-native \
    --disable-coccinelle \
    --enable-nfqueue \
    --enable-nflog \
    --enable-af-packet \
    --enable-jansson \
    --enable-geoip \
    --enable-lua \
    --enable-hiredis \
    --enable-non-bundled-htp

SZ Updated by Sergey Zhidkih 16 days ago Actions
Copy link
 #3

I can try to reproduce this on newer Suricata versions, as I has suspicions that it may not be the case anymore.

SZ Updated by Sergey Zhidkih 16 days ago Actions
Copy link
 #4

  • Label Needs backport to 8.0 added

It's still the case for current main branch commit (8455efd9ac9be052f5f5424805559611e8531b16)

tmqh-packetpool.c:351:42: runtime error: implicit conversion from type 'int' of value -1 (32-bit, signed) to type 'uint16_t' (aka 'unsigned short') changed the value to 65535 (16-bit, unsigned)
    #0 0x55b52fadbab7 in TmqhOutputPacketpool /artifacts/suricata/src/tmqh-packetpool.c:351:42
    #1 0x55b53008296f in PacketTunnelPktSetup /artifacts/suricata/src/decode.c:448:9
    #2 0x55b5312a1ba3 in DecodeGRE /artifacts/suricata/src/decode-gre.c:278:26
    #3 0x55b52ffbbc4a in DecodeIPV4 /artifacts/suricata/src/decode-ipv4.c:575:13
    #4 0x55b530082e2e in DecodeTunnel /artifacts/suricata/src/decode.c:193:20
    #5 0x55b5300826e8 in PacketTunnelPktSetup /artifacts/suricata/src/decode.c:439:11
    #6 0x55b5312a0b86 in DecodeGRE /artifacts/suricata/src/decode-gre.c:206:26
    #7 0x55b52ffbbc4a in DecodeIPV4 /artifacts/suricata/src/decode-ipv4.c:575:13
    #8 0x55b52ffb747a in DecodeNetworkLayer /artifacts/suricata/src/./decode.h:1502:13
    #9 0x55b52ffb67d1 in DecodeEthernet /artifacts/suricata/src/decode-ethernet.c:61:5
    #10 0x55b52fa851cb in DecodePcapFile /artifacts/suricata/src/source-pcap-file.c:470:9
    #11 0x55b52faad061 in TmThreadsSlotVarRun /artifacts/suricata/src/tm-threads.c:139:21
    #12 0x55b530cb5a5f in TmThreadsSlotProcessPkt /artifacts/suricata/src/./tm-threads.h:201:17
    #13 0x55b530ca8024 in PcapFileCallbackLoop /artifacts/suricata/src/source-pcap-file-helper.c:158:9
    #14 0x55b530ca4e25 in PcapFileDispatch /artifacts/suricata/src/source-pcap-file-helper.c:194:9
    #15 0x55b52fa8299e in ReceivePcapFileLoop /artifacts/suricata/src/source-pcap-file.c:220:18
    #16 0x55b52fa42c0b in LLVMFuzzerTestOneInput /artifacts/suricata/src/tests/fuzz/fuzz_decodepcapfile.c:100:9
    #17 0x55b52f93e3cb in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /usr/src/RPM/BUILD/llvm-project-20/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #18 0x55b52f92630f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /usr/src/RPM/BUILD/llvm-project-20/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:328:6
    #19 0x55b52f92c4a1 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /usr/src/RPM/BUILD/llvm-project-20/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:863:9
    #20 0x55b52f958632 in main /usr/src/RPM/BUILD/llvm-project-20/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #21 0x7fd518b6ac8b  (/lib64/libc.so.6+0x27c8b) (BuildId: 169e9c77efa2e23950e429aa9b36a179832d8ae6)
    #22 0x7fd518b6ad44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 169e9c77efa2e23950e429aa9b36a179832d8ae6)
    #23 0x55b52f920af0 in _start (/artifacts/debug_workdir/fuzz_decodepcapfile+0x14f9af0) (BuildId: c848abd25bb8485b160843c75178313353ee87ea)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior tmqh-packetpool.c:351:42

Here's full configuration options:

export CC=clang
export CXX=clang++
export 'RUSTFLAGS=-Cinstrument-coverage -Cdebuginfo=2 -Cforce-frame-pointers -Ccodegen-units=1 -Cpanic=abort -Copt-level=3'
export 'CFLAGS=-fprofile-instr-generate -fcoverage-mapping -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -gline-tables-only -O3 -fno-omit-frame-pointer -fsanitize=undefined -fsanitize=float-divide-by-zero -fsanitize=integer -fsanitize=implicit-conversion -fsanitize=local-bounds -fsanitize=nullability -fsanitize=vptr -fsanitize=address -fsanitize=alignment -g -O0'
export 'CXXFLAGS=-fprofile-instr-generate -fcoverage-mapping -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -gline-tables-only -O3 -fno-omit-frame-pointer -fsanitize=undefined -fsanitize=float-divide-by-zero -fsanitize=integer -fsanitize=implicit-conversion -fsanitize=local-bounds -fsanitize=nullability -fsanitize=vptr -fsanitize=address -fsanitize=alignment -g -O0'
export 'LDFLAGS= -fprofile-instr-generate -fcoverage-mapping'
./configure --enable-fuzztargets --enable-debug --enable-unittests --with-libpcre-includes=/usr/include/pcre --enable-gccprotect --enable-pie --disable-gccmarch-native --disable-coccinelle --enable-nfqueue --enable-nflog --enable-af-packet --enable-jansson --enable-geoip --enable-lua --enable-hiredis --enable-non-bundled-htp

SZ Updated by Sergey Zhidkih 16 days ago Actions
Copy link
 #5

  • Label deleted (Needs backport to 8.0)

PA Updated by Philippe Antoine 16 days ago Actions
Copy link
 #6

  • Status changed from Feedback to Triaged
  • Assignee changed from Sergey Zhidkih to OISF Dev
  • Target version changed from TBD to 9.0.0-beta1

Reproducing with
suricata --disable-detection -k none -c fuzz.yaml -r crash-ef6aaab27806c44e179464cc3cd35672aa381b86 with the supplied input

Actions
Copy link

Also available in: PDF Atom