Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 3938] New: ESP dissector has integer underflow

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3938

           Summary: ESP dissector has integer underflow
           Product: Wireshark
           Version: SVN
          Platform: x86
        OS/Version: Debian
            Status: NEW
          Severity: Major
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: laforge@xxxxxxxxxxxx


Build Information:
wireshark svn rev. 29482, built on Debian unstable, x86
--
when loading a certain pcap (which I cannot provide [yet], sorry), wireshark
crashes with the following message:

GLib-ERROR **:
/build/buildd-glib2.0_2.20.4-1-i386-6KfM1O/glib2.0-2.20.4/glib/gmem.c:136:
failed to allocate 4294967293 bytes
aborting...
[1]    28478 abort (core dumped)  ~/projects/svn/wireshark/wireshark
./reboot-call-sms.pcap

gdb tells me:

Program terminated with signal 6, Aborted.
#0  0xb80ba424 in __kernel_vsyscall ()
(gdb) bt
#0  0xb80ba424 in __kernel_vsyscall ()
#1  0xb5a433d0 in *__GI_raise (sig=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0xb5a46a85 in *__GI_abort () at abort.c:88
#3  0xb5ce740c in g_logv () from /usr/lib/libglib-2.0.so.0
#4  0xb5ce7436 in g_log () from /usr/lib/libglib-2.0.so.0
#5  0xb5ce592e in g_malloc () from /usr/lib/libglib-2.0.so.0
#6  0xb5cfdfce in g_memdup () from /usr/lib/libglib-2.0.so.0
#7  0xb6ab20cc in dissect_esp (tvb=0xa63b3a8, pinfo=0xbffd5cc4, tree=0xa386590)
    at packet-ipsec.c:2419
#8  0xb675a895 in call_dissector_through_handle (handle=0x9d383e8,
tvb=0xa63b3a8, 
    pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:376
#9  0xb675b06e in call_dissector_work (handle=0x9d383e8, tvb=0xa63b3a8, 
    pinfo_arg=0xbffd5cc4, tree=0xa386590, add_proto_name=1) at packet.c:467
#10 0xb675c279 in dissector_try_port_new (sub_dissectors=0x9d46760, port=50, 
    tvb=0xa63b3a8, pinfo=0xbffd5cc4, tree=0xa386590, add_proto_name=1)
    at packet.c:866
#11 0xb675c2e1 in dissector_try_port (sub_dissectors=0x9d46760, port=50, 
    tvb=0xa63b3a8, pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:892
#12 0xb6ab2841 in dissect_esp (tvb=0xa63b338, pinfo=0xbffd5cc4, tree=0xa386590)
    at packet-ipsec.c:2454
#13 0xb675a895 in call_dissector_through_handle (handle=0x9d383e8,
tvb=0xa63b338, 
    pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:376
#14 0xb675b06e in call_dissector_work (handle=0x9d383e8, tvb=0xa63b338, 
    pinfo_arg=0xbffd5cc4, tree=0xa386590, add_proto_name=1) at packet.c:467
#15 0xb675b20a in call_dissector (handle=0x9d383e8, tvb=0xa63b338, 
    pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:1796
#16 0xb6ab35dd in dissect_udpencap (tvb=0xa63b338, pinfo=0xbffd5cc4, 
    tree=0xa386590) at packet-ipsec-udp.c:81
#17 0xb675a895 in call_dissector_through_handle (handle=0xa118bb0,
tvb=0xa63b338, 
    pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:376
#18 0xb675b06e in call_dissector_work (handle=0xa118bb0, tvb=0xa63b338, 
    pinfo_arg=0xbffd5cc4, tree=0xa386590, add_proto_name=1) at packet.c:467
#19 0xb675c279 in dissector_try_port_new (sub_dissectors=0xa00af38, port=4500, 
    tvb=0xa63b338, pinfo=0xbffd5cc4, tree=0xa386590, add_proto_name=1)
    at packet.c:866
#20 0xb675c2e1 in dissector_try_port (sub_dissectors=0xa00af38, port=4500, 
    tvb=0xa63b338, pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:892
#21 0xb6d95bb4 in decode_udp_ports (tvb=0xa63b300, offset=8, pinfo=0xbffd5cc4, 
    tree=0xa386590, uh_sport=4500, uh_dport=4500, uh_ulen=124) at
packet-udp.c:286
#22 0xb6d96333 in dissect (tvb=0xa63b300, pinfo=0xbffd5cc4, tree=0xa386590, 
    ip_proto=17) at packet-udp.c:588
#23 0xb675a895 in call_dissector_through_handle (handle=0xa00aef8,
tvb=0xa63b300, 
    pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:376
#24 0xb675b06e in call_dissector_work (handle=0xa00aef8, tvb=0xa63b300, 
    pinfo_arg=0xbffd5cc4, tree=0xa386590, add_proto_name=1) at packet.c:467
#25 0xb675c279 in dissector_try_port_new (sub_dissectors=0x9d46760, port=17, 
    tvb=0xa63b300, pinfo=0xbffd5cc4, tree=0xa386590, add_proto_name=1)
    at packet.c:866
#26 0xb675c2e1 in dissector_try_port (sub_dissectors=0x9d46760, port=17, 
    tvb=0xa63b300, pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:892
#27 0xb6aa8e3e in dissect_ip (tvb=0xa63b2c8, pinfo=0xbffd5cc4, 
    parent_tree=0xa386590) at packet-ip.c:1668
#28 0xb675a895 in call_dissector_through_handle (handle=0x9d145f8,
tvb=0xa63b2c8, 
    pinfo=0xbffd5cc4, tree=0xa386590) at packet.c:376

Further investigation:

(gdb) frame 7
#7  0xb6ab20cc in dissect_esp (tvb=0xa63b3a8, pinfo=0xbffd5cc4, tree=0xa386590)
    at packet-ipsec.c:2419
2419                          tvb_decrypted = tvb_new_child_real_data(tvb,
g_memdup(decrypted_data+sizeof(guint8)*esp_iv_len,(decrypted_len -
esp_iv_len)*sizeof(guint8)), decrypted_len - esp_iv_len, decrypted_len -
esp_iv_len);
(gdb) p decrypted_len
$1 = 0
(gdb) p esp_iv_len
$3 = 16


which means decrypted_len - esp_iv len will render a negative value and thus
cause the problem.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.