Project

General

Profile

Bug #3117

Updated by Victor Julien 11 months ago

When running against a qa pcap I see he following valgrind reports. 

 <pre> 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x19607D: PacketCopyDataOffset (decode.c:236) 
 ==13958==      by 0x19607D: PacketCopyData (decode.c:262) 
 ==13958==      by 0x2C7E33: PcapFileCallbackLoop (source-pcap-file-helper.c:82) 
 ==13958==      by 0x62E6D18: ??? (in /usr/lib/x86_64-linux-gnu/libpcap.so.1.8.1) 
 ==13958==      by 0x2C8397: PcapFileDispatch (source-pcap-file-helper.c:138) 
 ==13958==      by 0x2C4FBD: ReceivePcapFileLoop (source-pcap-file.c:177) 
 ==13958==      by 0x2E26B0: TmThreadsSlotPktAcqLoop (tm-threads.c:335) 
 ==13958==      by 0x69386DA: start_thread (pthread_create.c:463) 
 ==13958==      by 0x840188E: clone (clone.S:95) 


 

 .... 
 ... 

 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x21506DB4: ??? 
 ==13958==      by 0x4CB924B7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ... 
 ... 
 .. 
 ==13958== Invalid read of size 1 
 ==13958==      at 0x8325A57: ____strtoul_l_internal (strtol_l.c:432) 
 ==13958==      by 0x2ED2DA: ByteExtractString (util-byte.c:212) 
 ==13958==      by 0x1AC730: DetectBytetestDoMatch (detect-bytetest.c:152) 
 ==13958==      by 0x1DBEA5: DetectEngineContentInspection (detect-engine-content-inspection.c:470) 
 ==13958==      by 0x1BF0D5: DetectEngineInspectBufferGeneric (detect-engine.c:1603) 
 ==13958==      by 0x1AEC38: DetectRunTxInspectRule (detect.c:1137) 
 ==13958==      by 0x1AEC38: DetectRunTx (detect.c:1456) 
 ==13958==      by 0x1AF388: DetectRun.part.15 (detect.c:136) 
 ==13958==      by 0x1B0337: DetectRun (detect.c:1583) 
 ==13958==      by 0x1B0337: DetectNoFlow (detect.c:1590) 
 ==13958==      by 0x1B0337: Detect (detect.c:1650) 
 ==13958==      by 0x253C20: FlowWorker (flow-worker.c:275) 
 ==13958==      by 0x2E1431: TmThreadsSlotVarRun (tm-threads.c:130) 
 ==13958==      by 0x2E2DD3: TmThreadsSlotVar (tm-threads.c:585) 
 ==13958==      by 0x69386DA: start_thread (pthread_create.c:463) 
 ==13958==    Address 0x2bf2d51b is 0 bytes after a block of size 27 alloc'd 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x4E447E1: bstr_dup_mem (bstr.c:259) 
 ==13958==      by 0x4E4BDFE: htp_parse_request_header_generic (htp_request_generic.c:264) 
 ==13958==      by 0x4E4BF0E: htp_process_request_header_generic (htp_request_generic.c:58) 
 ==13958==      by 0x4E4B11C: htp_connp_REQ_HEADERS (htp_request.c:685) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==      by 0x2D7232: ReassembleUpdateAppLayer (stream-tcp-reassemble.c:1066) 
 ==13958==      by 0x2D7232: StreamTcpReassembleAppLayer (stream-tcp-reassemble.c:1123) 
 ... 
 ... 
 .. 
 ==13958==  
 ==13958== Thread 5 W#03: 
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108ECB9C: ??? 
 ==13958==      by 0xF625AD7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108EABD4: ??? 
 ==13958==      by 0xF625AD7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108E8B44: ??? 
 ==13958==      by 0xF625AD7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x28F877A4: ??? 
 ==13958==      by 0xF625AD7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108ECB9C: ??? 
 ==13958==      by 0x12814357: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108EABD4: ??? 
 ==13958==      by 0x12814357: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108E8B44: ??? 
 ==13958==      by 0x12814357: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x1046C3FC: ??? 
 ==13958==      by 0x1F3AC607: ??? 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x210DB82C: ??? 
 ==13958==      by 0x1F3AC607: ??? 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x11E1BF34: ??? 
 ==13958==      by 0x1F3AC607: ??? 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x132860AF: ??? 
 ==13958==      by 0x204F9A17: ??? 
 ==13958==  
 ==13958== Thread 10 W#08: 
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x21506DB4: ??? 
 ==13958==      by 0x2246AD17: ??? 
 ==13958==  
 ==13958== Thread 6 W#04: 
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108ECB9C: ??? 
 ==13958==      by 0x179574A7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108EABD4: ??? 
 ==13958==      by 0x179574A7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x108E8B44: ??? 
 ==13958==      by 0x179574A7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ==13958==  
 ==13958== Conditional jump or move depends on uninitialised value(s) 
 ==13958==      at 0x28F877A4: ??? 
 ==13958==      by 0x179574A7: ??? 
 ==13958==    Uninitialised value was created by a heap allocation 
 ==13958==      at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) 
 ==13958==      by 0x4E443DC: bstr_alloc (bstr.c:44) 
 ==13958==      by 0x176655: SCHTPGenerateNormalizedUri (app-layer-htp-libhtp.c:114) 
 ==13958==      by 0x17508A: HTPCallbackRequestLine (app-layer-htp.c:2148) 
 ==13958==      by 0x4E480C9: htp_hook_run_all (htp_hooks.c:127) 
 ==13958==      by 0x4E4FE6C: htp_tx_state_request_line (htp_transaction.c:1010) 
 ==13958==      by 0x4E4B7BD: htp_connp_REQ_LINE_complete (htp_request.c:802) 
 ==13958==      by 0x4E4B91B: htp_connp_req_data (htp_request.c:1007) 
 ==13958==      by 0x171A9C: HTPHandleRequestData (app-layer-htp.c:787) 
 ==13958==      by 0x17D0CD: AppLayerParserParse (app-layer-parser.c:1210) 
 ==13958==      by 0x138AFC: TCPProtoDetect (app-layer.c:447) 
 ==13958==      by 0x13934F: AppLayerHandleTCPData (app-layer.c:615) 
 ... 
 ... 
 </pre> 

 Details of the run attached.

Back