UBSan violations in print-pflog.c and print-snmp.c #1054
Description
Tcpdump version:
tcpdump-original version 5.0.0-PRE-GIT
libpcap version 1.11.0-PRE-GIT (with TPACKET_V3)
OpenSSL 1.1.1f 31 Mar 2020
Compiled with AddressSanitizer/Clang.
Fuzzing tcpdump with our hybrid fuzzer has uncovered 3 Undefined Behavior Sanitizer violations in print-pflog.c and print-snmp.c. Reproducing pcaps are included and can be tested with tcpdump -e -r <filename>
left shift out of int bounds
$ /experiments/targets/tcpdump-original -e -r /tmp/crash_print-snmp-751
reading from file /tmp/crash_print-snmp-751, link-type SUNATM (Sun raw ATM), snapshot length 65535
[Invalid header: len(2693020224) > 262144]
[Invalid header: caplen==0, len(167772160) > 262144]
print-snmp.c:751:11: runtime error: left shift of 1141379156 by 7 places cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior print-snmp.c:751:11 in
Reproducer:
crash_print-snmp-751.pcap.tar.gz
left shift of negative value -1
$ /experiments/targets/tcpdump-original -e -r /tmp/crash_print-snmp-545.pcap
reading from file /tmp/crash_print-snmp-545.pcap, link-type SUNATM (Sun raw ATM), snapshot length 678101060
22:56:13.134349695 Rx: VPI:0 VCI:16 ilmi: [!init SEQ]0.0.2.7
22:56:13.134349695 Rx: VPI:0 VCI:16 ilmi: [!init SEQ]0.0.2.7
print-snmp.c:545:19: runtime error: left shift of negative value -1
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior print-snmp.c:545:19 in
Reproducer: crash_print-snmp-545.pcap.tar.gz
member access within misaligned address 0x61d0000000a2 for type 'const struct pfloghdr', which requires 4 byte alignment
$ /experiments/targets/tcpdump-original -e -r /tmp/crash_print-pflog-147.pcap
reading from file /tmp/crash_print-pflog-147.pcap, link-type PPI (Per-Packet Information), snapshot length 262144
[Invalid header: len(4278255616) > 262144]
[Invalid header: len(17891584) > 262144]
[Invalid header: len(18349825) > 262144]
print-pflog.c:147:6: runtime error: member access within misaligned address 0x61d0000000a2 for type 'const struct pfloghdr', which requires 4 byte alignment
0x61d0000000a2: note: pointer points here
00 00 00 01 01 01 54 01 01 01 be be be be be be be be be be be be be be be be be be be be be be
^
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior print-pflog.c:147:6 in
Reproducer:
crash_print-pflog-147.pcap.tar.gz