Bug #4246: Assertion failed in AdjustToAcked delta > 10000000ULL && delta > stream->window - Suricata - Open Information Security Foundation

Custom queries

8.0.0 Stories
Good First Issues
OISF community

Actions

Copy link

Bug #4246

closed

Assertion failed in AdjustToAcked delta > 10000000ULL && delta > stream->window

Added by Philippe Antoine almost 4 years ago. Updated over 3 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

7.0.0-beta1

Affected Versions:

6.0.1

Effort:

Difficulty:

Label:

Needs backport to 5.0, Needs backport to 6.0

Description

Found by oss-fuzz :
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28895

Files

lol.pcapng (4.8 KB) lol.pcapng

Suricata reproducer

Philippe Antoine, 12/30/2020 08:51 PM

Related issues 2 (0 open — 2 closed)

	Copied to Suricata - Bug #4341: Assertion failed in AdjustToAcked delta > 10000000ULL && delta > stream->window	Closed	Jeff Lucovsky				Actions
	Copied to Suricata - Bug #4342: Assertion failed in AdjustToAcked delta > 10000000ULL && delta > stream->window	Closed	Victor Julien				Actions

Issue # Delay: days Cancel

History
Notes
Property changes

Actions

Copy link

Updated by Philippe Antoine almost 4 years ago

File lol.pcapng lol.pcapng added

I do not know if this assertion is right.

I understand that the scenario to trigger this is :
Have a stream with a very big window > 10000000ULL, with tcp window being 0xFFFF and scale factor 8
Grow delta ie stream->last_ack - stream->base_seq bigger than 10000000ULL but smaller than window
Then have a packet with a small window, and delta will not have changed. Hence the assertion will trigger

Actions

Copy link

Updated by Philippe Antoine almost 4 years ago

Also https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29161

Actions

Copy link

Updated by Philippe Antoine almost 4 years ago

Assignee set to Victor Julien

Actions

Copy link

Updated by Victor Julien almost 4 years ago

Status changed from New to Assigned

Actions

Copy link

Updated by Victor Julien almost 4 years ago

I've not been able to get this to trigger with the pcap. How are you running it?

Actions

Copy link

Updated by Philippe Antoine almost 4 years ago

The pcap seems not to be a reproducer now...
Will try to craft another one later

Actions

Copy link

Updated by Philippe Antoine almost 4 years ago

suricata -r lol.pcapng -k none -c suricata.yaml
Trick is to enable HTTP2 in suricata.yaml

Actions

Copy link

Updated by Victor Julien over 3 years ago

Status changed from Assigned to Closed
Private changed from Yes to No
Label Needs backport to 5.0, Needs backport to 6.0 added

https://github.com/OISF/suricata/commit/00d7c9034be7470177c01e8805831c258b016d0e

Actions

Copy link

Updated by Philippe Antoine over 3 years ago

Status changed from Closed to In Progress

Fix seems incomplete as per https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30885
fuzz_sigpcap: stream-tcp-reassemble.c:989: _Bool CheckGap(TcpSession *, TcpStream *, Packet *): Assertion `!((delta > 10000000ULL && delta > stream->window))' failed.

Actions

Copy link

#10