Buildbot crash output: fuzz-2015-09-25-17583.pcap

Buildbot Builder said:

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2015-09-25-17583.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/12569-Mavericks_Remote_Virtual_Interface_Capture.pcapng

Build host information:
Linux wsbb04 3.13.0-61-generic #100-Ubuntu SMP Wed Jul 29 11:21:34 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:	Ubuntu
Description:	Ubuntu 14.04.3 LTS
Release:	14.04
Codename:	trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=3319
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=ca495768c04f04f6bfe97216809ce7f09b1c8c6d

Return value:  0

Dissector bug:  0

Valgrind error count:  2



Git commit
commit ca495768c04f04f6bfe97216809ce7f09b1c8c6d
Author: Guy Harris <guy@alum.mit.edu>
Date:   Tue Sep 22 22:47:46 2015 -0700

    $, not %, is used to introduce a variable reference in CMake.

    Change-Id: Ib4af3c5cee9bd2e1adb5758b9389611165e62b62
    Reviewed-on: https://code.wireshark.org/review/10619
    Reviewed-by: Guy Harris <guy@alum.mit.edu>


Command and args: ./tools/valgrind-wireshark.sh

==1332== Memcheck, a memory error detector
==1332== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==1332== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==1332== Command: /home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark -nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2015-09-25-17583.pcap
==1332==
==1332== Invalid read of size 1
==1332==    at 0xB930C6A: inflate (in /lib/x86_64-linux-gnu/libz.so.1.2.8)
==1332==    by 0x682C7F1: tvb_uncompress (tvbuff_zlib.c:111)
==1332==    by 0x682CC12: tvb_child_uncompress (tvbuff_zlib.c:335)
==1332==    by 0x6B99B33: dissect_http_message (packet-http.c:1375)
==1332==    by 0x6B96E8B: dissect_http (packet-http.c:2950)
==1332==    by 0x67F956F: call_dissector_work (packet.c:618)
==1332==    by 0x67F940E: dissector_try_uint_new (packet.c:1163)
==1332==    by 0x6F6A0C3: decode_tcp_ports (packet-tcp.c:4149)
==1332==    by 0x6F6B129: process_tcp_payload (packet-tcp.c:4207)
==1332==    by 0x6F6A67E: dissect_tcp_payload (packet-tcp.c:2011)
==1332==    by 0x6F6E319: dissect_tcp (packet-tcp.c:5115)
==1332==    by 0x67F958D: call_dissector_work (packet.c:620)
==1332==  Address 0x15b7b22a is 0 bytes after a block of size 10 alloc'd
==1332==    at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1332==    by 0xA387610: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==1332==    by 0x682DB7E: tvb_memdup (tvbuff.c:829)
==1332==    by 0x682C663: tvb_uncompress (tvbuff_zlib.c:70)
==1332==    by 0x682CC12: tvb_child_uncompress (tvbuff_zlib.c:335)
==1332==    by 0x6B99B33: dissect_http_message (packet-http.c:1375)
==1332==    by 0x6B96E8B: dissect_http (packet-http.c:2950)
==1332==    by 0x67F956F: call_dissector_work (packet.c:618)
==1332==    by 0x67F940E: dissector_try_uint_new (packet.c:1163)
==1332==    by 0x6F6A0C3: decode_tcp_ports (packet-tcp.c:4149)
==1332==    by 0x6F6B129: process_tcp_payload (packet-tcp.c:4207)
==1332==    by 0x6F6A67E: dissect_tcp_payload (packet-tcp.c:2011)
==1332==
==1332== Invalid read of size 1
==1332==    at 0xB930C94: inflate (in /lib/x86_64-linux-gnu/libz.so.1.2.8)
==1332==    by 0x682C7F1: tvb_uncompress (tvbuff_zlib.c:111)
==1332==    by 0x682CC12: tvb_child_uncompress (tvbuff_zlib.c:335)
==1332==    by 0x6B99B33: dissect_http_message (packet-http.c:1375)
==1332==    by 0x6B96E8B: dissect_http (packet-http.c:2950)
==1332==    by 0x67F956F: call_dissector_work (packet.c:618)
==1332==    by 0x67F940E: dissector_try_uint_new (packet.c:1163)
==1332==    by 0x6F6A0C3: decode_tcp_ports (packet-tcp.c:4149)
==1332==    by 0x6F6B129: process_tcp_payload (packet-tcp.c:4207)
==1332==    by 0x6F6A67E: dissect_tcp_payload (packet-tcp.c:2011)
==1332==    by 0x6F6E319: dissect_tcp (packet-tcp.c:5115)
==1332==    by 0x67F958D: call_dissector_work (packet.c:620)
==1332==  Address 0x15b7b22b is 1 bytes after a block of size 10 alloc'd
==1332==    at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1332==    by 0xA387610: g_malloc (in /lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==1332==    by 0x682DB7E: tvb_memdup (tvbuff.c:829)
==1332==    by 0x682C663: tvb_uncompress (tvbuff_zlib.c:70)
==1332==    by 0x682CC12: tvb_child_uncompress (tvbuff_zlib.c:335)
==1332==    by 0x6B99B33: dissect_http_message (packet-http.c:1375)
==1332==    by 0x6B96E8B: dissect_http (packet-http.c:2950)
==1332==    by 0x67F956F: call_dissector_work (packet.c:618)
==1332==    by 0x67F940E: dissector_try_uint_new (packet.c:1163)
==1332==    by 0x6F6A0C3: decode_tcp_ports (packet-tcp.c:4149)
==1332==    by 0x6F6B129: process_tcp_payload (packet-tcp.c:4207)
==1332==    by 0x6F6A67E: dissect_tcp_payload (packet-tcp.c:2011)
==1332==
==1332==
==1332== HEAP SUMMARY:
==1332==     in use at exit: 1,061,410 bytes in 28,206 blocks
==1332==   total heap usage: 683,962 allocs, 655,756 frees, 48,081,322 bytes allocated
==1332==
==1332== LEAK SUMMARY:
==1332==    definitely lost: 3,028 bytes in 132 blocks
==1332==    indirectly lost: 36,536 bytes in 54 blocks
==1332==      possibly lost: 0 bytes in 0 blocks
==1332==    still reachable: 1,021,846 bytes in 28,020 blocks
==1332==         suppressed: 0 bytes in 0 blocks
==1332== Rerun with --leak-check=full to see details of leaked memory
==1332==
==1332== For counts of detected and suppressed errors, rerun with: -v
==1332== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)

[ no debug trace ]

added crash libwireshark osubuntu labels

Bill Meier said:

*** Bug #11554 (closed) has been marked as a duplicate of this bug. ***

Gerrit Code Review said:

Change 12038 had a related patch set uploaded by Peter Wu: Fix buffer overrun in zlib decompression

https://code.wireshark.org/review/12038

Peter Wu said:

In the worst case this can lead to a program crash, causing a denial of service. The overrun can be at most double the size of the input buffer.

Reproduced with:

/*
clang -g -fsanitize=address -I/tmp/wireshark $(pkg-config --cflags glib-2.0) repro.c -L/tmp/wsbuild/run -lwireshark -lwsutil -lwiretap $(pkg-config --libs glib-2.0) -o repro

LD_LIBRARY_PATH=/tmp/wsbuild/run:/tmp/zlib-asan/lib ./repro
 */
#include <epan/tvbuff.h>

int main(int argc, const char *argv[])
{
    tvbuff_t *tvb, *new_tvb = NULL;
    guint8 data[] = {
        0x1f, 0x8b,         /* ID1. ID2 (Magic) */
        0x8,                /* Compression method: deflate (8) */
        0,                  /* Flags */
        0x0, 0x0, 0x0, 0x0, /* MTIME */
        0x0,                /* XFL */
        0x0,                /* OS */
    };
    guint data_len = sizeof(data);
    tvb = tvb_new_real_data(data, data_len, data_len);
    new_tvb = tvb_uncompress(tvb, 0, data_len);
    g_print("new_tvb = %p\n", new_tvb);
    return 0;
}

Peter Wu said:

Created attachment 14026 gzip-encoded http response having a name of 1MB bytes

Here is a specially crafted. Also just realized that it is likely not that much of an issue as the zlib library will return as soon as invalid data is encountered (so a buffer overrun by at most a few bytes).