Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Line: fix heap-buffer-overflow error #2015

Merged
merged 1 commit into from
Jun 21, 2023
Merged

Line: fix heap-buffer-overflow error #2015

merged 1 commit into from
Jun 21, 2023

Commits on Jun 20, 2023

  1. Line: fix heap-buffer-overflow error

    ```
    ==24482==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000001dd at pc 0x561abd2dbda4 bp 0x7ffdcc7370b0 sp 0x7ffdcc7370a8
    READ of size 1 at 0x6030000001dd thread T0
        #0 0x561abd2dbda3 in ndpi_search_line /home/ivan/svnrepos/nDPI/src/lib/protocols/line.c:67:4
        ntop#1 0x561abd165f5a in check_ndpi_detection_func /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:5926:6
        ntop#2 0x561abd166d1b in check_ndpi_udp_flow_func /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:5962:10
        ntop#3 0x561abd1666bc in ndpi_check_flow_func /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:5995:12
        ntop#4 0x561abd17774f in ndpi_internal_detection_process_packet /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:6991:15
        ntop#5 0x561abd1738a7 in ndpi_detection_process_packet /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:7158:22
        ntop#6 0x561abd0a47fd in LLVMFuzzerTestOneInput /home/ivan/svnrepos/nDPI/fuzz/fuzz_process_packet.c:24:5
        ntop#7 0x561abcfb6670 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/ivan/svnrepos/nDPI/fuzz/fuzz_process_packet+0x48d670) (BuildId: 6011a561322c60a0cdc8c96cf524bff75e7aaf2e)
        ntop#8 0x561abcfa0bff in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/ivan/svnrepos/nDPI/fuzz/fuzz_process_packet+0x477bff) (BuildId: 6011a561322c60a0cdc8c96cf524bff75e7aaf2e)
        ntop#9 0x561abcfa66c6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/ivan/svnrepos/nDPI/fuzz/fuzz_process_packet+0x47d6c6) (BuildId: 6011a561322c60a0cdc8c96cf524bff75e7aaf2e)
        ntop#10 0x561abcfcf2b2 in main (/home/ivan/svnrepos/nDPI/fuzz/fuzz_process_packet+0x4a62b2) (BuildId: 6011a561322c60a0cdc8c96cf524bff75e7aaf2e)
        ntop#11 0x7f079b4be082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
        ntop#12 0x561abcf9badd in _start (/home/ivan/svnrepos/nDPI/fuzz/fuzz_process_packet+0x472add) (BuildId: 6011a561322c60a0cdc8c96cf524bff75e7aaf2e)
    
    0x6030000001dd is located 0 bytes after 29-byte region [0x6030000001c0,0x6030000001dd)
    allocated by thread T0 here:
    [...]
    ```
    
    Found by oss-fuzz
    Fix 66bee47
    
    Not sure about the "best" length check; I simply use the minimum valid
    value.
    IvanNardi committed Jun 20, 2023
    Configuration menu
    Copy the full SHA
    031b63b View commit details
    Browse the repository at this point in the history