[oss-fuzz] UBSAN: shift exponent 32 is too large for 32-bit type 'int' in packet-sigcomp.c:3857:24

This issue was migrated from bug 13641 in our old bug tracker.

Original bug information:

Reporter: Peter Wu
Status: RESOLVED FIXED
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: Linux
Platform: x86-64
Version: Git

Attachments:

clusterfuzz-testcase-minimized-5531351153377280.pcap: Packet capture file

Peter Wu said:

Build Information: TShark (Wireshark) 2.3.0 (v2.3.0rc0-3251-gf3aaa5cd54)

Copyright 1998-2017 Gerald Combs <gerald@‍wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3, with GLib 2.50.3, with zlib 1.2.11, without SMI, with c-ares 1.12.0, with Lua 5.2.4, with GnuTLS 3.5.11, with Gcrypt 1.7.6, with MIT Kerberos, with GeoIP, with nghttp2 1.20.0, with LZ4, with Snappy, with libxml2 2.9.4.

Running on Linux 4.10.9-1-ARCH, with Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (with SSE4.2), with 31996 MB of physical memory, with locale C, with libpcap version 1.8.1, with GnuTLS 3.5.11, with Gcrypt 1.7.6, with zlib 1.2.11.

Built using clang 4.2.1 Compatible Clang 4.0.0 (tags/RELEASE_400/final).

A problem was found by the oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1232

Attached is the sample that triggers this error which can be reproduced with an
ASAN+UBSAN build of Wireshark ("tshark -Vr test.pcap").
--
/tmp/ws-review/epan/dissectors/packet-sigcomp.c:3857:24: runtime error: shift exponent 32 is too large for 32-bit type 'int'
    #0 0x7f31bba0bc89 in decompress_sigcomp_message /tmp/ws-review/epan/dissectors/packet-sigcomp.c:3857:24
    #1 0x7f31bb9f0772 in dissect_sigcomp_common /tmp/ws-review/epan/dissectors/packet-sigcomp.c:4995:30
    #2 0x7f31bb9ec008 in dissect_sigcomp /tmp/ws-review/epan/dissectors/packet-sigcomp.c:4639:12
    #3 0x7f31bd6f529d in call_dissector_through_handle /tmp/ws-review/epan/packet.c:684:8
    #4 0x7f31bd6dfa9f in call_dissector_work /tmp/ws-review/epan/packet.c:759:9
    #5 0x7f31bd6deabd in dissector_try_uint_new /tmp/ws-review/epan/packet.c:1329:8
    #6 0x7f31bd6dfff9 in dissector_try_uint /tmp/ws-review/epan/packet.c:1353:9
    #7 0x7f31bbf45b66 in decode_udp_ports /tmp/ws-review/epan/dissectors/packet-udp.c:678:7
    #8 0x7f31bbf5b642 in dissect /tmp/ws-review/epan/dissectors/packet-udp.c:1131:5
    #9 0x7f31bbf4a96f in dissect_udp /tmp/ws-review/epan/dissectors/packet-udp.c:1137:3
    #10 0x7f31bd6f529d in call_dissector_through_handle /tmp/ws-review/epan/packet.c:684:8
    #11 0x7f31bd6dfa9f in call_dissector_work /tmp/ws-review/epan/packet.c:759:9
    #12 0x7f31bd6deabd in dissector_try_uint_new /tmp/ws-review/epan/packet.c:1329:8
    #13 0x7f31bac2955c in ip_try_dissect /tmp/ws-review/epan/dissectors/packet-ip.c:1854:7
    #14 0x7f31bac384e6 in dissect_ip_v4 /tmp/ws-review/epan/dissectors/packet-ip.c:2315:10
    #15 0x7f31bd6f529d in call_dissector_through_handle /tmp/ws-review/epan/packet.c:684:8
    #16 0x7f31bd6dfa9f in call_dissector_work /tmp/ws-review/epan/packet.c:759:9
    #17 0x7f31bd6deabd in dissector_try_uint_new /tmp/ws-review/epan/packet.c:1329:8
    #18 0x7f31bd6dfff9 in dissector_try_uint /tmp/ws-review/epan/packet.c:1353:9
    #19 0x7f31ba6a52c3 in dissect_ethertype /tmp/ws-review/epan/dissectors/packet-ethertype.c:267:21
    #20 0x7f31bd6f529d in call_dissector_through_handle /tmp/ws-review/epan/packet.c:684:8
    #21 0x7f31bd6dfa9f in call_dissector_work /tmp/ws-review/epan/packet.c:759:9
    #22 0x7f31bd6ee6b7 in call_dissector_only /tmp/ws-review/epan/packet.c:2992:8
    #23 0x7f31bd6d6864 in call_dissector_with_data /tmp/ws-review/epan/packet.c:3005:8
    #24 0x7f31ba6a149e in dissect_eth_common /tmp/ws-review/epan/dissectors/packet-eth.c:536:5
    #25 0x7f31ba696d27 in dissect_eth /tmp/ws-review/epan/dissectors/packet-eth.c:800:5
    #26 0x7f31bd6f529d in call_dissector_through_handle /tmp/ws-review/epan/packet.c:684:8
    #27 0x7f31bd6dfa9f in call_dissector_work /tmp/ws-review/epan/packet.c:759:9
    #28 0x7f31bd6deabd in dissector_try_uint_new /tmp/ws-review/epan/packet.c:1329:8
    #29 0x7f31ba7d96b7 in dissect_frame /tmp/ws-review/epan/dissectors/packet-frame.c:521:11
    #30 0x7f31bd6f529d in call_dissector_through_handle /tmp/ws-review/epan/packet.c:684:8
    #31 0x7f31bd6dfa9f in call_dissector_work /tmp/ws-review/epan/packet.c:759:9
    #32 0x7f31bd6ee6b7 in call_dissector_only /tmp/ws-review/epan/packet.c:2992:8
    #33 0x7f31bd6d6864 in call_dissector_with_data /tmp/ws-review/epan/packet.c:3005:8
    #34 0x7f31bd6d5884 in dissect_record /tmp/ws-review/epan/packet.c:567:3
    #35 0x7f31bd666048 in epan_dissect_run_with_taps /tmp/ws-review/epan/epan.c:474:2
    #36 0x55888e879c86 in process_packet_single_pass /tmp/ws-review/tshark.c:3395:5
    #37 0x55888e872e0e in load_cap_file /tmp/ws-review/tshark.c:3232:11
    #38 0x55888e86ab31 in main /tmp/ws-review/tshark.c:1954:13
    #39 0x7f31aecce510 in __libc_start_main (/usr/lib/libc.so.6+0x20510)
    #40 0x55888e758389 in _start (/tmp/ws-review/build/run/tshark+0xd0389)

SUMMARY: AddressSanitizer: undefined-behavior /tmp/ws-review/epan/dissectors/packet-sigcomp.c:3857:24 in

added crash libwireshark oslinux versiondev labels

Peter Wu said:

Created attachment 15489 Packet capture file

Gerrit Code Review said:

Change 21369 merged by Michael Mann: packet-sigcomp.c: Prevent large shift

https://code.wireshark.org/review/21369

Gerrit Code Review said:

Change 21373 had a related patch set uploaded by Michael Mann: packet-sigcomp.c: Prevent large shift

https://code.wireshark.org/review/21373

Gerrit Code Review said:

Change 21373 merged by Michael Mann: packet-sigcomp.c: Prevent large shift

https://code.wireshark.org/review/21373

Gerrit Code Review said:

Change 21374 had a related patch set uploaded by Michael Mann: packet-sigcomp.c: Prevent large shift

https://code.wireshark.org/review/21374

Gerrit Code Review said:

Change 21374 merged by Michael Mann: packet-sigcomp.c: Prevent large shift

https://code.wireshark.org/review/21374

Gerald Combs said:

I'm assuming that this isn't exploitable and doesn't cause a denial of service, and therefore doesn't warrant a CVE ID. If it does please let me know.

closed