[BUG] stack-buffer-overflow on address 0x7fff816d7800 at pc 0x00000067b2b2 bp 0x7fff816d74d0 sp 0x7fff816d74c8 WRITE of size 1 at 0x7fff816d7800 thread T0

[zlowram]

Hi!

I've been running a fuzzer on PcapPlusPlus and found some bugs that I'm currently reporting.

Below you can find the AddressSanitizer stacktrace as well as the sample that triggers the bug. With this information you should be able to reproduce it.

If you'd like to reproduce the AddressSanitizer stacktrace, I've sent a PR that does an initial integration of the fuzzers within the project structure and build chain.

INFO: Seed: 2525608950
INFO: Loaded 1 modules   (68 inline 8-bit counters): 68 [0x784f60, 0x784fa4), 
INFO: Loaded 1 PC tables (68 PCs): 68 [0x7221d0,0x722610), 
Tests/Fuzzers/Bin/fuzz_target: Running 1 inputs 1 time(s) each.
Running: ../fuzzers/bugs/crash-63a98d125029876ba4f2e75550382ceffbb251e2
=================================================================
==371849==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff816d7800 at pc 0x00000067b2b2 bp 0x7fff816d74d0 sp 0x7fff816d74c8
WRITE of size 1 at 0x7fff816d7800 thread T0
    #0 0x67b2b1 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:69:18
    #1 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #2 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #3 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #4 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #5 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #6 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #7 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #8 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #9 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #10 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #11 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #12 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #13 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #14 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #15 0x67af43 in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:66:14
    #16 0x67b53d in pcpp::IDnsResource::IDnsResource(pcpp::DnsLayer*, unsigned long) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:16:27
    #17 0x62489a in pcpp::DnsQuery::DnsQuery(pcpp::DnsLayer*, unsigned long) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/./header/DnsResource.h:133:92
    #18 0x62489a in pcpp::DnsLayer::parseResources() /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsLayer.cpp:172:48
    #19 0x624f71 in pcpp::DnsLayer::DnsLayer(unsigned char*, unsigned long, pcpp::Layer*, pcpp::Packet*) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsLayer.cpp:26:16
    #20 0x5f57e1 in pcpp::UdpLayer::parseNextLayer() /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/UdpLayer.cpp:103:65
    #21 0x5fe084 in pcpp::Packet::setRawPacket(pcpp::RawPacket*, bool, unsigned long, pcpp::OsiModelLayer) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/Packet.cpp:63:27
    #22 0x5b78c9 in LLVMFuzzerTestOneInput /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Tests/Fuzzers/fuzz_target.cc:52:15
    #23 0x4bf768 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/z/self/src/research/pcapplusplus/PcapPlusPlus/Tests/Fuzzers/Bin/fuzz_target+0x4bf768)
    #24 0x4a4885 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/z/self/src/research/pcapplusplus/PcapPlusPlus/Tests/Fuzzers/Bin/fuzz_target+0x4a4885)
    #25 0x4ad7c9 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/z/self/src/research/pcapplusplus/PcapPlusPlus/Tests/Fuzzers/Bin/fuzz_target+0x4ad7c9)
    #26 0x466996 in main (/home/z/self/src/research/pcapplusplus/PcapPlusPlus/Tests/Fuzzers/Bin/fuzz_target+0x466996)
    #27 0x7feb3a6bd1a2 in __libc_start_main (/lib64/libc.so.6+0x271a2)
    #28 0x49d87d in _start (/home/z/self/src/research/pcapplusplus/PcapPlusPlus/Tests/Fuzzers/Bin/fuzz_target+0x49d87d)

Address 0x7fff816d7800 is located in stack of thread T0 at offset 288 in frame
    #0 0x67ab6f in pcpp::IDnsResource::decodeName(char const*, char*, int) /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:34:1

  This frame has 1 object(s):
    [32, 288) 'tempResult' (line 64) <== Memory access at offset 288 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/z/self/src/research/pcapplusplus/PcapPlusPlus/Packet++/src/DnsResource.cpp:69:18 in pcpp::IDnsResource::decodeName(char const*, char*, int)
Shadow bytes around the buggy address:
  0x1000702d2eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000702d2ec0: 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 f3 f3 00 00
  0x1000702d2ed0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x1000702d2ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000702d2ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1000702d2f00:[f3]f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
  0x1000702d2f10: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00
  0x1000702d2f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000702d2f30: 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3
  0x1000702d2f40: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000702d2f50: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==371849==ABORTING

Sample: crash-63a98d125029876ba4f2e75550382ceffbb251e2.zip

[seladb]

Fixed