https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13619
Bug ID: 13619
Summary: [oss-fuzz] UBSAN: shift exponent -5 is negative in
packet-sigcomp.c:1722:36
Product: Wireshark
Version: Git
Hardware: x86-64
URL: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=
1172
OS: Linux (other)
Status: CONFIRMED
Severity: Major
Priority: High
Component: Dissection engine (libwireshark)
Assignee: bugzilla-ad...@wireshark.org
Reporter: pe...@lekensteyn.nl
Target Milestone: ---
Build Information:
TShark (Wireshark) 2.3.0 (v2.3.0rc0-3201-g913f9fb353)
Copyright 1998-2017 Gerald Combs <ger...@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3,
with GLib 2.50.3, with zlib 1.2.11, without SMI, with c-ares 1.12.0, with Lua
5.2.4, with GnuTLS 3.5.10, with Gcrypt 1.7.6, with MIT Kerberos, with GeoIP,
with nghttp2 1.20.0, with LZ4, with Snappy.
Running on Linux 4.10.9-1-ARCH, with Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
(with SSE4.2), with 31996 MB of physical memory, with locale C, with libpcap
version 1.8.1, with GnuTLS 3.5.10, with Gcrypt 1.7.6, with zlib 1.2.11.
Built using clang 4.2.1 Compatible Clang 3.9.1 (tags/RELEASE_391/final).
--
A problem was found by the oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1172
Attached is the sample that triggers this error which can be reproduced with an
ASAN+UBSAN build of Wireshark ("tshark -Vr test.pcap").
--
epan/dissectors/packet-sigcomp.c:1722:36: runtime error: shift exponent -5 is
negative
#0 0x7efdcdd1d624 in decomp_dispatch_get_bits
epan/dissectors/packet-sigcomp.c:1722:36
#1 0x7efdcdd02a6b in decompress_sigcomp_message
epan/dissectors/packet-sigcomp.c:3830:21
#2 0x7efdcdce7b8c in dissect_sigcomp_common
epan/dissectors/packet-sigcomp.c:4986:30
#3 0x7efdcdce3438 in dissect_sigcomp
epan/dissectors/packet-sigcomp.c:4630:12
#4 0x7efdcfa4b77d in call_dissector_through_handle epan/packet.c:684:8
#5 0x7efdcfa35edf in call_dissector_work epan/packet.c:759:9
#6 0x7efdcfa34efd in dissector_try_uint_new epan/packet.c:1329:8
#7 0x7efdcfa36439 in dissector_try_uint epan/packet.c:1353:9
#8 0x7efdce23cbdb in decode_udp_ports epan/dissectors/packet-udp.c:673:7
#9 0x7efdce252702 in dissect epan/dissectors/packet-udp.c:1131:5
#10 0x7efdce241a3f in dissect_udp epan/dissectors/packet-udp.c:1137:3
#11 0x7efdcfa4b77d in call_dissector_through_handle epan/packet.c:684:8
#12 0x7efdcfa35edf in call_dissector_work epan/packet.c:759:9
#13 0x7efdcfa34efd in dissector_try_uint_new epan/packet.c:1329:8
#14 0x7efdccf2120c in ip_try_dissect epan/dissectors/packet-ip.c:1854:7
#15 0x7efdccf30196 in dissect_ip_v4 epan/dissectors/packet-ip.c:2315:10
#16 0x7efdcfa4b77d in call_dissector_through_handle epan/packet.c:684:8
#17 0x7efdcfa35edf in call_dissector_work epan/packet.c:759:9
#18 0x7efdcfa34efd in dissector_try_uint_new epan/packet.c:1329:8
#19 0x7efdcfa36439 in dissector_try_uint epan/packet.c:1353:9
#20 0x7efdcc99f44b in dissect_ethertype
epan/dissectors/packet-ethertype.c:267:21
#21 0x7efdcfa4b77d in call_dissector_through_handle epan/packet.c:684:8
#22 0x7efdcfa35edf in call_dissector_work epan/packet.c:759:9
#23 0x7efdcfa44b07 in call_dissector_only epan/packet.c:2992:8
#24 0x7efdcfa2cc44 in call_dissector_with_data epan/packet.c:3005:8
#25 0x7efdcc99b620 in dissect_eth_common epan/dissectors/packet-eth.c:536:5
#26 0x7efdcc990ea7 in dissect_eth epan/dissectors/packet-eth.c:800:5
#27 0x7efdcfa4b77d in call_dissector_through_handle epan/packet.c:684:8
#28 0x7efdcfa35edf in call_dissector_work epan/packet.c:759:9
#29 0x7efdcfa34efd in dissector_try_uint_new epan/packet.c:1329:8
#30 0x7efdccad3857 in dissect_frame epan/dissectors/packet-frame.c:521:11
#31 0x7efdcfa4b77d in call_dissector_through_handle epan/packet.c:684:8
#32 0x7efdcfa35edf in call_dissector_work epan/packet.c:759:9
#33 0x7efdcfa44b07 in call_dissector_only epan/packet.c:2992:8
#34 0x7efdcfa2cc44 in call_dissector_with_data epan/packet.c:3005:8
#35 0x7efdcfa2bc73 in dissect_record epan/packet.c:567:3
#36 0x7efdcf9bc7b8 in epan_dissect_run_with_taps epan/epan.c:462:2
#37 0x55ff7e975d53 in process_packet_single_pass tshark.c:3560:5
#38 0x55ff7e96e233 in load_cap_file tshark.c:3311:11
#39 0x55ff7e9655a6 in main tshark.c:1972:13
#40 0x7efdc141a510 in __libc_start_main (/usr/lib/libc.so.6+0x20510)
#41 0x55ff7e85a359 in _start (run/tshark+0xd1359)
SUMMARY: AddressSanitizer: undefined-behavior
epan/dissectors/packet-sigcomp.c:1722:36 in
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <wireshark-bugs@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
