https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16458
Bug ID: 16458
Summary: Read of uninitialized memory in detect_camins_file
Product: Wireshark
Version: Git
Hardware: x86
OS: Linux
Status: UNCONFIRMED
Severity: Major
Priority: Low
Component: Capture file support (libwiretap)
Assignee: bugzilla-ad...@wireshark.org
Reporter: fabien.lheur...@trust-in-soft.com
Target Milestone: ---
Created attachment 17694
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=17694&action=edit
This pcap file was generated by AFL and should allow to reproduce the issue
Build Information:
Paste the COMPLETE build information from "Help->About Wireshark", "wireshark
-v", or "tshark -v".
--
## Analysis Context
*The verification was performed with TrustInSoft Analyzer, a formal
static analyzer for C and C++.*
*The result is part of a larger security assessment performed by
TrustInSoft for* ***Naval Group***.
The analysis of wireshark was performed in the following environment:
----------------- ----------------------------------------------
Platform Ubuntu Linux 18.04
Tool TrustInSoft Analyzer, a formal static analyzer
Input Files Fuzzing of 10 000 pcap file using AFL
Verification Analysis of `process_cap_file` with the AFL corpus
------------- ----------------------------------------------
------------ ------------------- ---------------------- ----------------
Wireshark version v2.6.16rc0 git commit dcd65a4012
https://github.com/wireshark/wireshark.git
glib version 2.62.6 git commit eb0f73a39
https://github.com/GNOME/glib.git
libgcrypt version 1.8.5 git commit ada758e3
https://github.com/gpg/libgcrypt.git
libgpg-error version 1.37 git commit 85b5006
https://github.com/gpg/libgpg-error.git
libpcap version 1.9.1 git commit 1547215c
https://github.com/the-tcpdump-group/libpcap.git
pcre version 8.43-RC1 git commit 10e4adb
https://github.com/svn2github/pcre.git
pcre2 version 10.10 git commit a677f5b
https://github.com/luvit/pcre2.git
zlib version 10.10 git commit a677f5b
https://github.com/madler/zlib.git
------------ ------------------- ---------------------- ----------------
- valgrind is deactivated in glib
- PCRE library is deactivated in glib
- `cap_files_hashes` is deactivated in wireshark
## Uninitialized Variable in *detect_camins_file*
In the function `detect_camins_file`, the variable `err` may be
uninitialized in the evaluation of the conditional statement `err ==
WTAP_ERR_SHORT_READ` when `wtap_read_bytes` returns a value different
from `0` but did not write into `err`.
File: wireshark/wiretap/camins.c
```c
while (wtap_read_bytes(fh, block, sizeof(block), &err, &err_info)) {
if (err == WTAP_ERR_SHORT_READ)
break;
```
Indeed, in the function `wtap_read_bytes`, if the condition
`bytes_read < 0 || (guint)bytes_read != count` is false, `err` remains
uninitialized.
File: wireshark/wiretap/wtap.c
```c
gboolean
wtap_read_bytes(FILE_T fh, void *buf, unsigned int count, int *err,
gchar **err_info)
{
int bytes_read;
bytes_read = file_read(buf, count, fh);
if (bytes_read < 0 || (guint)bytes_read != count) {
*err = file_error(fh, err_info);
if (*err == 0)
*err = WTAP_ERR_SHORT_READ;
return FALSE;
}
return TRUE;
}
```
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
