Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ASan: global-buffer-overflow ./bin/nfx.c:504 in VerifyExtensionMap #179

Closed
fgeek opened this issue Aug 6, 2019 · 6 comments

Comments

@fgeek
Copy link

commented Aug 6, 2019

Tested commit: 0dbf646
Credits: Henri Salo
Tools: american fuzzy lop 2.53b, afl-utils
006-nfcapd.txt (d54ea5b0bc1f241bbc5d034eb03179dab85e65ee)

$ nfdump -r 006-nfcapd.txt
Date first seen          Duration Proto      Src IP Addr:Port          Dst IP Addr:Port   Packets    Bytes Flows
Verify map id 12336: ERROR: element id 81 out of range [49]
=================================================================
==27546==ERROR: AddressSanitizer: global-buffer-overflow on address 0x556a202857da at pc 0x7f1ec1fd2021 bp 0x7fff632470d0 sp 0x7fff632470c8
READ of size 2 at 0x556a202857da thread T0
    #0 0x7f1ec1fd2020 in VerifyExtensionMap /home/hsalo/src/nfdump/bin/nfx.c:504
    #1 0x7f1ec1fd265e in Insert_Extension_Map /home/hsalo/src/nfdump/bin/nfx.c:197
    #2 0x556a2021f2bb in process_data /home/hsalo/src/nfdump/bin/nfdump.c:574
    #3 0x556a2021f2bb in main /home/hsalo/src/nfdump/bin/nfdump.c:1152
    #4 0x7f1ec1d5809a in __libc_start_main ../csu/libc-start.c:308
    #5 0x556a20227359 in _start (/home/hsalo/builds/nfdump/0dbf64628b458fa3ab86654c7e74d39f66c58707/bin/nfdump+0x19359)

0x556a202857da is located 6 bytes to the left of global variable 'total_flows' defined in 'nfdump.c:96:17' (0x556a202857e0) of size 4
0x556a202857da is located 54 bytes to the right of global variable 'skipped_blocks' defined in 'nfdump.c:97:17' (0x556a202857a0) of size 4
SUMMARY: AddressSanitizer: global-buffer-overflow /home/hsalo/src/nfdump/bin/nfx.c:504 in VerifyExtensionMap
Shadow bytes around the buggy address:
  0x0aadc4048aa0: 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9
  0x0aadc4048ab0: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0aadc4048ac0: 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0aadc4048ad0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9
  0x0aadc4048ae0: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9
=>0x0aadc4048af0: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9[f9]04 f9 f9 f9
  0x0aadc4048b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0aadc4048b10: 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0aadc4048b20: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
  0x0aadc4048b30: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x0aadc4048b40: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==27546==ABORTING
$ hexdump -C 006-nfcapd.txt
00000000  0c a5 01 00 00 30 30 30  30 30 30 30 30 30 30 30  |.....00000000000|
00000010  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
*
00000110  30 30 30 30 30 30 30 30  30 00 00 00 02 00 30 30  |000000000.....00|
00000120  02 00 0c 00 ff ff 00 00  00 00 30 30 02 00 30 00  |..........00..0.|
00000130  30 30 30 30 51 00 30 30  30 30 30 30 30 30 30 30  |0000Q.0000000000|
00000140  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000150
phaag pushed a commit that referenced this issue Aug 7, 2019
@phaag

This comment has been minimized.

Copy link
Owner

commented Aug 7, 2019

Thx. Fixed.

@phaag phaag closed this Aug 7, 2019

@fgeek

This comment has been minimized.

Copy link
Author

commented Aug 8, 2019

@phaag README.md "is a toolset in oder to collect" is that a typo?

@phaag

This comment has been minimized.

Copy link
Owner

commented Aug 10, 2019

Why?

@fgeek

This comment has been minimized.

Copy link
Author

commented Aug 10, 2019

Should it be "in order to"?

@phaag

This comment has been minimized.

Copy link
Owner

commented Aug 10, 2019

Ahh - I see - I was blind - sorry

@fgeek

This comment has been minimized.

Copy link
Author

commented Aug 10, 2019

No worries. Have a nice day!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.