https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16487

            Bug ID: 16487
           Summary: tshark live capture finishes with an out-of-bounds
                    read
           Product: Wireshark
           Version: 3.2.3
          Hardware: All
                OS: All
            Status: CONFIRMED
          Severity: Major
          Priority: Medium
         Component: TShark
          Assignee: bugzilla-ad...@wireshark.org
          Reporter: pe...@lekensteyn.nl
  Target Milestone: ---

Build Information:
TShark (Wireshark) 3.3.0 (v3.3.0rc0-972-g43c4e886256a)

Copyright 1998-2020 Gerald Combs <ger...@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<https://www.gnu.org/licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3,
with GLib 2.62.2, with zlib 1.2.11, without SMI, with c-ares 1.15.0, with Lua
5.2.4, with GnuTLS 3.6.12 and PKCS #11 support, with Gcrypt 1.8.5, with MIT
Kerberos, with MaxMind DB resolver, with nghttp2 1.39.2, with brotli, with LZ4,
with Zstandard, with Snappy, with libxml2 2.9.10.

Running on Linux 5.5.6-arch1-1, with Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
(with SSE4.2), with 64143 MB of physical memory, with locale en_US.UTF-8, with
libpcap version 1.9.1 (with TPACKET_V3), with GnuTLS 3.6.12, with Gcrypt 1.8.5,
with brotli 1.0.7, with zlib 1.2.11, binary plugins supported (0 loaded).

Built using clang Clang 9.0.1 .
--
On exiting tshark after a live capture, it crashes due to an out-of-bounds
read.

Steps to reproduce:
1. cmake -GNinja -DENABLE_ASAN=1
2. ninja tshark dumpcap randpktdump
3. tshark -i randpkt -c1
(This is a minimum non-interactive reproducer that does not require capture
permissions. It can also be reproduced with a real interface.)

Expected result:
Capture stops with no issues.

Actual result:
valgrind reports two invalid reads, ASAN blows up (see trace at the end).

More information:
This issue was introduced in commit v3.2.3rc0-57-g84cf682883 (fixing Bug 16457)
which has unfortunately been backported and released today. Apart from git
master, it affects 3.0.10 and 3.2.3 only. I initially triggered it on macOS and
could reproduce this regression on Linux.

ASAN trace:
$ tshark -i randpkt -c1
Capturing on 'Random packet generator: randpkt'
    1   0.000000              → 0x7ad4       IEEE 802.15.4 3595 Reserved, Dst:
0x7ad4[Malformed Packet: length of contained item exceeds length of containing
item][Malformed Packet]
1 packet captured
=================================================================
==140142==ERROR: AddressSanitizer: heap-use-after-free on address
0x604000000550 at pc 0x7efc27003dc5 bp 0x7ffeed6852c0 sp 0x7ffeed6852b8
READ of size 8 at 0x604000000550 thread T0
    #0 0x7efc27003dc4 in wtap_block_free_option wiretap/wtap_opttypes.c:200:16
    #1 0x7efc26ffa024 in wtap_block_free_options wiretap/wtap_opttypes.c:224:9
    #2 0x7efc26ff9c60 in wtap_block_free wiretap/wtap_opttypes.c:236:9
    #3 0x7efc26ffa251 in wtap_block_array_free wiretap/wtap_opttypes.c:250:9
    #4 0x7efc26ff3c37 in wtap_close wiretap/wtap.c:1254:2
    #5 0x56238f9b7fc2 in cf_close tshark.c:4248:5
    #6 0x56238f9adb35 in main tshark.c:2284:3
    #7 0x7efc265f7022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)
    #8 0x56238f88602d in _start (run/tshark+0x13d02d)

0x604000000550 is located 0 bytes inside of 40-byte region
[0x604000000550,0x604000000578)
freed by thread T0 here:
    #0 0x56238f927229 in free (run/tshark+0x1de229)
    #1 0x7efc268720cd in array_free
/usr/src/debug/build/../glib/glib/garray.c:386:7
    #2 0x7efc27008c7e in wtap_opttypes_cleanup wiretap/wtap_opttypes.c:1275:17
    #3 0x7efc26ff8b9d in wtap_cleanup wiretap/wtap.c:1624:2
    #4 0x56238f9adb24 in main tshark.c:2282:3
    #5 0x7efc265f7022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)
    #6 0x56238f88602d in _start (run/tshark+0x13d02d)

previously allocated by thread T0 here:
    #0 0x56238f927559 in malloc (run/tshark+0x1de559)
    #1 0x7efc26843929 in g_malloc
/usr/src/debug/build/../glib/glib/gmem.c:99:13
    #2 0x7efc268248f3 in g_slice_alloc
/usr/src/debug/build/../glib/glib/gslice.c:1024:11
    #3 0x7efc268788d4 in g_array_sized_new
/usr/src/debug/build/../glib/glib/garray.c:194:11
    #4 0x7efc270080ee in wtap_opttype_block_register
wiretap/wtap_opttypes.c:100:26
    #5 0x7efc27004f2a in wtap_opttypes_initialize
wiretap/wtap_opttypes.c:1224:5
    #6 0x7efc26ff8994 in wtap_init wiretap/wtap.c:1607:2
    #7 0x56238f9a38da in main tshark.c:916:3
    #8 0x7efc265f7022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)
    #9 0x56238f88602d in _start (run/tshark+0x13d02d)

SUMMARY: AddressSanitizer: heap-use-after-free wiretap/wtap_opttypes.c:200:16
in wtap_block_free_option
Shadow bytes around the buggy address:
  0x0c087fff8050: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8060: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
  0x0c087fff8070: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff8080: fa fa 00 00 00 00 00 fa fa fa fd fd fd fd fd fa
  0x0c087fff8090: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
=>0x0c087fff80a0: fa fa fd fd fd fd fd fa fa fa[fd]fd fd fd fd fa
  0x0c087fff80b0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff80c0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff80d0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
  0x0c087fff80e0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
  0x0c087fff80f0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==140142==ABORTING

-- 
You are receiving this mail because:
You are watching all bug changes.
___________________________________________________________________________
Sent via:    Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives:    https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
             mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

Reply via email to