Skip to content

Commit

Permalink
reader_util: fix TZSP decapsulation (#1460)
Browse files Browse the repository at this point in the history
```
==38674==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400008957f at pc 0x5653fcee6434 bp 0x7ffe9b554b50 sp 0x7ffe9b554b48
READ of size 1 at 0x60400008957f thread T0
    #0 0x5653fcee6433 in ndpi_workflow_process_packet /home/ivan/svnrepos/nDPI/example/reader_util.c:2050:18
    #1 0x5653fce9fc0d in LLVMFuzzerTestOneInput /home/ivan/svnrepos/nDPI/fuzz/fuzz_ndpi_reader.c:107:7
    #2 0x5653fcea03eb in main /home/ivan/svnrepos/nDPI/fuzz/fuzz_ndpi_reader.c:179:17
    #3 0x7fe71dc3d0b2 in __libc_start_main /build/glibc-YbNSs7/glibc-2.31/csu/../csu/libc-start.c:308:16
    #4 0x5653fcddf67d in _start (/home/ivan/svnrepos/nDPI/fuzz/fuzz_ndpi_reader_with_main+0x58a67d) (BuildId: 525418a27e8c37d6c492cc3220e0e97809c40f98)

0x60400008957f is located 0 bytes to the right of 47-byte region [0x604000089550,0x60400008957f)
allocated by thread T0 here:
```

Found by oss-fuzz
See: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=45036
  • Loading branch information
IvanNardi authored Feb 27, 2022
1 parent 8b06229 commit 61a3c2e
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions example/reader_util.c
Original file line number Diff line number Diff line change
Expand Up @@ -2047,6 +2047,8 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
tag_len = 1, stop = 1;
break;
default:
if(offset + 1 >= header->caplen)
return(nproto); /* Invalid packet */
tag_len = packet[offset+1];
break;
}
Expand Down

0 comments on commit 61a3c2e

Please sign in to comment.