-
Notifications
You must be signed in to change notification settings - Fork 290
Closed
Labels
Description
Describe the bug
heap-buffer-overflow in tcpreplay with fast_edit_packet()
ASAN report
=================================================================
==126819==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6160000002ce at pc 0x0000004ca8fc bp 0x7fffab94b540 sp 0x7fffab94b538
READ of size 2 at 0x6160000002ce thread T0
#0 0x4ca8fb in fast_edit_packet /programs/tcpreplay/tcpreplay-4.3.3/src/send_packets.c:276:18
#1 0x4c8fa7 in send_packets /programs/tcpreplay/tcpreplay-4.3.3/src/send_packets.c:562:13
#2 0x4d619c in replay_file /programs/tcpreplay/tcpreplay-4.3.3/src/replay.c:182:5
#3 0x4d619c in tcpr_replay_index /programs/tcpreplay/tcpreplay-4.3.3/src/replay.c:59:29
#4 0x4d3ff7 in tcpreplay_replay /programs/tcpreplay/tcpreplay-4.3.3/src/tcpreplay_api.c:1136:26
#5 0x4ce979 in main /programs/tcpreplay/tcpreplay-4.3.3/src/tcpreplay.c:139:13
#6 0x7fd5f344b0b2 in __libc_start_main /build/glibc-YYA7BZ/glibc-2.31/csu/../csu/libc-start.c:308:16
#7 0x41c65d in _start (/programs/tcpreplay/asan/usr/local/bin/tcpreplay+0x41c65d)
0x6160000002ce is located 4 bytes to the right of 586-byte region [0x616000000080,0x6160000002ca)
allocated by thread T0 here:
#0 0x4966cd in malloc (/programs/tcpreplay/asan/usr/local/bin/tcpreplay+0x4966cd)
#1 0x4da815 in _our_safe_malloc /programs/tcpreplay/tcpreplay-4.3.3/src/common/utils.c:50:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /programs/tcpreplay/tcpreplay-4.3.3/src/send_packets.c:276:18 in fast_edit_packet
Shadow bytes around the buggy address:
0x0c2c7fff8000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2c7fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2c7fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2c7fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c2c7fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2c7fff8050: 00 00 00 00 00 00 00 00 00[02]fa fa fa fa fa fa
0x0c2c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2c7fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c2c7fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==126819==ABORTING
To Reproduce
Steps to reproduce the behavior:
- install tcpreplay 4.3.3
- run tcpreplay as:
tcpreplay -i eth0 -tK --loop 2 --unique-ip [pco_file]
Expected behavior
refuse abnormal input and exit, without throwing bug information
System
- OS: Ubuntu_20.04.1 x86_64
- Tcpreplay Version 4.3.3
tcpreplay -V
tcpreplay version: 4.3.3 (build git:v4.3.3)
Copyright 2013-2018 by Fred Klassen <tcpreplay at appneta dot com> - AppNeta
Copyright 2000-2012 by Aaron Turner <aturner at synfin dot net>
The entire Tcpreplay Suite is licensed under the GPLv3
Cache file supported: 04
Not compiled with libdnet.
Compiled against libpcap: 1.9.1
64 bit packet counters: enabled
Verbose printing via tcpdump: disabled
Packet editing: disabled
Fragroute engine: disabled
Injection method: PF_PACKET send()
Not compiled with netma
Additional context
tcpreplay_crash_2.zip
Reactions are currently unavailable