Closed
Description
Is there an already existing issue for this?
- I have searched the existing issues
Expected behavior
Malformed submessages handled gracefully.
Current behavior
I came across two following issues.
- An SPDP payload with a malformed heartbeat submessage triggers an assertion failure at
fastrtps/include/fastdds/rtps/common/SequenceNumber.h:247. - This only happens when fastrtps is compiled with the following CMake arguments for logging:
--cmake-args -DCMAKE_BUILD_TYPE=Debug -DLOG_NO_INFO=OFF -DINTERNAL_DEBUG=ON -DLOG_CONSUMER_DEFAULT=STDOUT -DLOG_NO_WARNING=OFF -DLOG_NO_ERROR=OFF
Steps to reproduce
- Build fastdds v2.9.0 and HelloWorldExample with logging (Debug mode)
mkdir -p ~/fastdds-log/src
cd ~/fastdds-log
wget https://raw.githubusercontent.com/eProsima/Fast-DDS/v2.9.0/fastrtps.repos
vcs import src < fastrtps.repos
colcon build --cmake-args -DCMAKE_BUILD_TYPE=Debug -DLOG_NO_INFO=OFF -DINTERNAL_DEBUG=ON -DLOG_CONSUMER_DEFAULT=STDOUT -DLOG_NO_WARNING=OFF -DLOG_NO_ERROR=OFF
source install/setup.sh
cd src/fastrtps/examples/cpp/dds/HelloWorldExample
cmake .
make
- Build fastdds v2.9.0 and HelloWorldExample without logging
mkdir -p ~/fastdds-nolog/src
cd ~/fastdds-nolog
wget https://raw.githubusercontent.com/eProsima/Fast-DDS/v2.9.0/fastrtps.repos
vcs import src < fastrtps.repos
colcon build
source install/setup.sh
cd src/fastrtps/examples/cpp/dds/HelloWorldExample
cmake .
make
-
Launch
DDSHelloWorldExamplewith logging and send the malformed packet- Launching:
source ~/fastdds-log/install/setup.sh && ~/fastdds-log/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample publisher- Hexdump of the SPDP packet to send (to
239.255.0.1:7400):
0000 45 00 00 68 00 01 40 00 40 11 D9 76 80 3D F0 CF E..h..@.@..v.=.. 0010 EF FF 00 01 05 39 1C E8 00 54 08 B9 52 54 50 53 .....9...T..RTPS 0020 02 04 01 0F 01 03 02 42 AC 11 00 02 45 E5 E2 FD .......B....E... 0030 07 BF 34 00 00 00 10 00 00 00 00 00 00 01 00 C2 ..4............. 0040 00 00 00 00 A7 9B EA 8C BE ED DC CB 00 03 00 00 ................ 0050 77 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 w............... 0060 00 00 00 00 00 00 00 00 ........- Result after sending the packet:
Starting Publisher running 10 samples. DDSHelloWorldExample: /home/seulbae/fastdds-log/src/fastrtps/include/fastdds/rtps/common/SequenceNumber.h:247: eprosima::fastrtps::rtps::SequenceNumber_t eprosima::fastrtps::rtps::operator-(const eprosima::fastrtps::rtps::SequenceNumber_t&, uint32_t): Assertion `0 < res.high' failed. [1] 3561127 abort publisherAssertion failure has been triggered!
-
Launch
DDSHelloWorldExamplewithout logging and send the malformed packet- Launching:
source ~/fastdds-nolog/install/setup.sh && ~/fastdds-nolog/src/fastrtps/examples/cpp/dds/HelloWorldExample/DDSHelloWorldExample publisher-
Send the same SPDP packet
-
Result after sending:
Starting Publisher running 10 samples.No assertion failure this time..
Fast DDS version/commit
Tag v2.9.0 (4c55488)
Platform/Architecture
Ubuntu Focal 20.04 amd64
Transport layer
Default configuration, UDPv4 & SHM
Additional context
Alternatively, you can directly use this PoC to quickly test the behavior. But make sure to compile this with an afl compiler (e.g., afl-clang-fast++) or manually enable the FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION flag to keep participantGuidPrefix uninitialized.
Thank you.
XML configuration file
No response
Relevant log output
No response
Network traffic capture
No response