Bug #43
closedProcessing the attached pcap causes abort in StreamMsgFree at exit.
Description
coz@coz-desktop:~/downloads/suricatafuzz1$ gdb src/suricata core
GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/coz/downloads/suricatafuzz1/src/suricata...done.
warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libhtp-0.1.so.1...done.
Loaded symbols for /usr/lib/libhtp-0.1.so.1
Reading symbols from /usr/lib/libpcap.so.0.8...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpcap.so.0.8
Reading symbols from /usr/local/lib/libpfring.so...done.
Loaded symbols for /usr/local/lib/libpfring.so
Reading symbols from /usr/lib/libnet.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libnet.so.1
Reading symbols from /lib/libpthread.so.0...Reading symbols from /usr/lib/debug/lib/libpthread-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /usr/lib/libyaml-0.so.1...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libyaml-0.so.1
Reading symbols from /lib/libpcre.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/libpcre.so.3
Reading symbols from /lib/libc.so.6...Reading symbols from /usr/lib/debug/lib/libc-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/libz.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from /usr/lib/debug/lib/ld-2.10.1.so...done.
(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Reading symbols from /lib/libgcc_s.so.1...(no debugging symbols found)...done.
Loaded symbols for /lib/libgcc_s.so.1
Core was generated by `src/suricata c ../suricata117.yaml -r ./defconctf-segv-7890-3.pcap -l ./'.
Program terminated with signal 6, Aborted.
#0 0x00007fecab5364b5 in *GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt full
#0 0x00007fecab5364b5 in *_GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
pid = <value optimized out>
selftid = <value optimized out>
#1 0x00007fecab539f50 in *_GI_abort () at abort.c:92
act = {__sigaction_handler = {sa_handler = 0x300000009, sa_sigaction = 0x300000009}, sa_mask = {__val = {140735516351328, 140735516351184, 140735516351376, 140735516362242, 12, 140654464437503, 3, 140735516351386, 6,
140654464437507, 2, 140735516351374, 2, 140654464428625, 1, 140654464437503}}, sa_flags = 3, sa_restorer = 0x7fff8a759b94}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007fecab56ec97 in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff8a75a500, reg_save_area = 0x7fff8a75a410}}
ap_copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff8a75a500, reg_save_area = 0x7fff8a75a410}}
fd = 3
on_2 = <value optimized out>
list = <value optimized out>
nlist = 1024
cp = <value optimized out>
written = false
#3 0x00007fecab578dd6 in malloc_printerr (action=3, str=0x7fecab63a638 "munmap_chunk(): invalid pointer", ptr=<value optimized out>) at malloc.c:6217
buf = "0000000002eade30"
cp = 0x0
#4 0x0000000000478871 in StreamMsgFree (ptr=0x2eade30) at stream.c:44
s = 0x2eade30
#5 0x0000000000463919 in PoolFree (p=0x2e74b20) at util-pool.c:77
pb = 0x2e9aad0
#6 0x0000000000478bae in StreamMsgQueuesDeinit (quiet=0 '\000') at stream.c:151
No locals.
#7 0x000000000047e0dc in StreamTcpReassembleFree (quiet=0 '\000') at stream-tcp-reassemble.c:174
u16 = 8
#8 0x00000000004791e6 in StreamTcpFreeConfig (quiet=0 '\000') at stream-tcp.c:270
__FUNCTION = "StreamTcpFreeConfig"
#9 0x0000000000405558 in main (argc=7, argv=0x7fff8a75b1c8) at suricata.c:749
opt = -1
mode = 2
pcap_file = 0x7fff8a75c629 "./defconctf-segv-7890-3.pcap"
pcap_dev = 0x0
pfring_dev = 0x0
sig_file = 0x0
nfq_id = 0
conf_filename = 0x7fff8a75c612 "../suricata117.yaml"
dump_config = 0
list_unittests = 0
daemon = 0
log_dir = 0x171f1a0 "./"
buf = {st_dev = 2055, st_ino = 16679048, st_nlink = 7, st_mode = 16877, st_uid = 1000, st_gid = 1000, pad0 = 0, st_rdev = 0, st_size = 12288, st_blksize = 4096, st_blocks = 24, st_atim = {tv_sec = 1262645653, tv_nsec = 0},
st_mtim = {tv_sec = 1262644882, tv_nsec = 0}, st_ctim = {tv_sec = 1262644882, tv_nsec = 0}, __unused = {0, 0, 0}}
long_opts = {{name = 0x49de08 "dump-config", has_arg = 0, flag = 0x7fff8a75ac9c, val = 1}, {name = 0x49de14 "pfring-int", has_arg = 1, flag = 0x0, val = 0}, {name = 0x49de1f "pfring-clusterid", has_arg = 1, flag = 0x0,
val = 0}, {name = 0x49de30 "unittest-filter", has_arg = 1, flag = 0x0, val = 85}, {name = 0x49de40 "list-unittests", has_arg = 0, flag = 0x7fff8a75ac98, val = 1}, {name = 0x49de4f "init-errors-fatal", has_arg = 0,
flag = 0x0, val = 0}, {name = 0x49de61 "fatal-unittests", has_arg = 0, flag = 0x0, val = 0}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
option_index = 0
short_opts = "c:Dhi:l:q:r:us:U:V"
__FUNCTION = "main"
c = 255 '\377'
i = 50
de_ctx = 0x1e0ffa0
af_logfile_ctx = 0x20504c0
ad_logfile_ctx = 0x2050510
lh_logfile_ctx = 0x2050560
---Type <return> to continue, or q <return> to quit--
aul_logfile_ctx = 0x20505d0
aua_logfile_ctx = 0x2050620
au2a_logfile_ctx = 0x2050670
start_time = {tv_sec = 1262646002, tv_usec = 557201}
Files
Updated by Gurvinder Singh almost 15 years ago
- File 0001-bug-41-patch.patch 0001-bug-41-patch.patch added
- Status changed from New to Resolved
The issue was due to not updating the stream->last_ack in the TCP closewait state. This was causing wrong payload_len in StreamTcpReassembleHandleSegmentUpdateACK(). The patch seems to fix the issue, as there is no segv after running with given pcap.
Updated by Gurvinder Singh almost 15 years ago
- Status changed from Resolved to Closed
patch applied!!