-
Notifications
You must be signed in to change notification settings - Fork 290
Closed
Labels
Description
Describe the bug
heap-buff-overflow in tcpreplay with get_next_packet()
ASAN report
=================================================================
==75256==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000210 at pc 0x000000495b27 bp 0x7ffd73bf07f0 sp 0x7ffd73beffb8
READ of size 74 at 0x603000000210 thread T0
#0 0x495b26 in __asan_memcpy (/programs/tcpreplay/asan/usr/local/bin/tcpreplay+0x495b26)
#1 0x4c7f74 in get_next_packet /programs/tcpreplay/tcpreplay-4.3.3/src/send_packets.c:1060:21
#2 0x4c7724 in preload_pcap_file /programs/tcpreplay/tcpreplay-4.3.3/src/send_packets.c:442:23
#3 0x4ce64c in main/programs/tcpreplay/tcpreplay-4.3.3/src/tcpreplay.c:126:13
#4 0x7faac54110b2 in __libc_start_main /build/glibc-YYA7BZ/glibc-2.31/csu/../csu/libc-start.c:308:16
#5 0x41c65d in _start (/programs/tcpreplay/asan/usr/local/bin/tcpreplay+0x41c65d)
0x603000000210 is located 0 bytes to the right of 32-byte region [0x6030000001f0,0x603000000210)
allocated by thread T0 here:
#0 0x4969e9 in realloc (/programs/tcpreplay/asan/usr/local/bin/tcpreplay+0x4969e9)
#1 0x7faac57bcd77 (/lib/x86_64-linux-gnu/libpcap.so.0.8+0x23d77)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/programs/tcpreplay/asan/usr/local/bin/tcpreplay+0x495b26) in __asan_memcpy
Shadow bytes around the buggy address:
0x0c067fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c067fff8000: fa fa fd fd fd fa fa fa fd fd fd fd fa fa fd fd
0x0c067fff8010: fd fd fa fa fd fd fd fa fa fa fd fd fd fa fa fa
0x0c067fff8020: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fd
0x0c067fff8030: fa fa 00 00 02 fa fa fa fd fd fd fd fa fa 00 00
=>0x0c067fff8040: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c067fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==75256==ABORTING
To Reproduce
Steps to reproduce the behavior:
- install replay 4.3.3
- run replay as:
tcpreplay -i eth0 -tK [poc_file]
Expected behavior
refuse abnormal input and exit, without throwing bug information
System
- OS: Ubuntu_20.04.1 x86_64
- Tcpreplay Version 4.3.3
tcpreplay -V
tcpreplay version: 4.3.3 (build git:v4.3.3)
Copyright 2013-2018 by Fred Klassen <tcpreplay at appneta dot com> - AppNeta
Copyright 2000-2012 by Aaron Turner <aturner at synfin dot net>
The entire Tcpreplay Suite is licensed under the GPLv3
Cache file supported: 04
Not compiled with libdnet.
Compiled against libpcap: 1.9.1
64 bit packet counters: enabled
Verbose printing via tcpdump: disabled
Packet editing: disabled
Fragroute engine: disabled
Injection method: PF_PACKET send()
Not compiled with netma
Additional context
poc_file
tcpreplay_crash_1.zip
Reactions are currently unavailable