{"action":"created","issue":{"url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/557","repository_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump","labels_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/557/labels{/name}","comments_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/557/comments","events_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/557/events","html_url":"https://github.com/the-tcpdump-group/tcpdump/issues/557","id":187925455,"number":557,"title":"Heap out of bounds read in bootp_print()","user":{"login":"fumfel","id":5985287,"avatar_url":"https://avatars.githubusercontent.com/u/5985287?v=3","gravatar_id":"","url":"https://api.github.com/users/fumfel","html_url":"https://github.com/fumfel","followers_url":"https://api.github.com/users/fumfel/followers","following_url":"https://api.github.com/users/fumfel/following{/other_user}","gists_url":"https://api.github.com/users/fumfel/gists{/gist_id}","starred_url":"https://api.github.com/users/fumfel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fumfel/subscriptions","organizations_url":"https://api.github.com/users/fumfel/orgs","repos_url":"https://api.github.com/users/fumfel/repos","events_url":"https://api.github.com/users/fumfel/events{/privacy}","received_events_url":"https://api.github.com/users/fumfel/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"infrastation","id":900115,"avatar_url":"https://avatars.githubusercontent.com/u/900115?v=3","gravatar_id":"","url":"https://api.github.com/users/infrastation","html_url":"https://github.com/infrastation","followers_url":"https://api.github.com/users/infrastation/followers","following_url":"https://api.github.com/users/infrastation/following{/other_user}","gists_url":"https://api.github.com/users/infrastation/gists{/gist_id}","starred_url":"https://api.github.com/users/infrastation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/infrastation/subscriptions","organizations_url":"https://api.github.com/users/infrastation/orgs","repos_url":"https://api.github.com/users/infrastation/repos","events_url":"https://api.github.com/users/infrastation/events{/privacy}","received_events_url":"https://api.github.com/users/infrastation/received_events","type":"User","site_admin":false},"assignees":[{"login":"infrastation","id":900115,"avatar_url":"https://avatars.githubusercontent.com/u/900115?v=3","gravatar_id":"","url":"https://api.github.com/users/infrastation","html_url":"https://github.com/infrastation","followers_url":"https://api.github.com/users/infrastation/followers","following_url":"https://api.github.com/users/infrastation/following{/other_user}","gists_url":"https://api.github.com/users/infrastation/gists{/gist_id}","starred_url":"https://api.github.com/users/infrastation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/infrastation/subscriptions","organizations_url":"https://api.github.com/users/infrastation/orgs","repos_url":"https://api.github.com/users/infrastation/repos","events_url":"https://api.github.com/users/infrastation/events{/privacy}","received_events_url":"https://api.github.com/users/infrastation/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-11-08T08:01:05Z","updated_at":"2016-12-23T20:58:09Z","closed_at":"2016-12-23T20:58:09Z","body":"**Heap out of bounds read in bootp_print()**\r\n\r\nTested on Git HEAD:  e2adb166ecaf59555e18787e86ac8c828efa0acc\r\n\r\nTo reproduce: `tcpdump -r oobr_bootp_print.pcap`\r\n\r\n![Crashing test case - please change extension to '.pcap'](https://cloud.githubusercontent.com/assets/5985287/20091209/cfd01abc-a591-11e6-8591-d4e7ef382bed.png)\r\n\r\nASAN output:\r\n\r\n```\r\n==8091==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000dfbc at pc 0x00000053d61d bp 0x7fffb28645b0 sp 0x7fffb28645a8\r\nREAD of size 1 at 0x60400000dfbc thread T0\r\n    #0 0x53d61c in bootp_print XYZ/tcpdump/./print-bootp.c:294:31\r\n    #1 0x691493 in udp_print XYZ/tcpdump/./print-udp.c:551:4\r\n    #2 0x58f360 in ip_print_demux XYZ/tcpdump/./print-ip.c:383:3\r\n    #3 0x592006 in ip_print XYZ/tcpdump/./print-ip.c:648:3\r\n    #4 0x566f7c in ethertype_print XYZ/tcpdump/./print-ether.c:325:10\r\n    #5 0x566418 in ether_print XYZ/tcpdump/./print-ether.c:229:7\r\n    #6 0x501b12 in pretty_print_packet XYZ/tcpdump/./print.c:339:18\r\n    #7 0x4eebeb in print_packet XYZ/tcpdump/./tcpdump.c:2492:2\r\n    #8 0x7adaf7 in pcap_offline_read XYZ/libpcap/./savefile.c:527:4\r\n    #9 0x6b6f4c in pcap_loop XYZ/libpcap/./pcap.c:890:8\r\n    #10 0x4ea1db in main XYZ/tcpdump/./tcpdump.c:1996:12\r\n    #11 0x7f1a5e44b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n    #12 0x419ff8 in _start (/usr/local/sbin/tcpdump+0x419ff8)\r\n\r\n0x60400000dfbc is located 0 bytes to the right of 44-byte region [0x60400000df90,0x60400000dfbc)\r\nallocated by thread T0 here:\r\n    #0 0x4b880c in malloc /home/development/llvm/3.9.0/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64:3\r\n    #1 0x7af103 in pcap_check_header XYZ/libpcap/./sf-pcap.c:401:14\r\n    #2 0x7acf22 in pcap_fopen_offline_with_tstamp_precision XYZ/libpcap/./savefile.c:400:7\r\n    #3 0x7accaf in pcap_open_offline_with_tstamp_precision XYZ/libpcap/./savefile.c:307:6\r\n    #4 0x7f1a5e44b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow XYZ/tcpdump/./print-bootp.c:294:31 in bootp_print\r\nShadow bytes around the buggy address:\r\n  0x0c087fff9ba0: fa fa fa fa fa fa fa fa fa fa 00 00 00 00 00 fa\r\n  0x0c087fff9bb0: fa fa 00 00 00 00 05 fa fa fa 00 00 00 00 05 fa\r\n  0x0c087fff9bc0: fa fa 00 00 00 00 06 fa fa fa 00 00 00 00 06 fa\r\n  0x0c087fff9bd0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa\r\n  0x0c087fff9be0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd\r\n=>0x0c087fff9bf0: fa fa 00 00 00 00 00[04]fa fa 00 00 00 00 00 01\r\n  0x0c087fff9c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c087fff9c10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c087fff9c20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c087fff9c30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c087fff9c40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07\r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==8091==ABORTING\r\n\r\n\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/comments/269044911","html_url":"https://github.com/the-tcpdump-group/tcpdump/issues/557#issuecomment-269044911","issue_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/557","id":269044911,"user":{"login":"fxlb","id":2846004,"avatar_url":"https://avatars.githubusercontent.com/u/2846004?v=3","gravatar_id":"","url":"https://api.github.com/users/fxlb","html_url":"https://github.com/fxlb","followers_url":"https://api.github.com/users/fxlb/followers","following_url":"https://api.github.com/users/fxlb/following{/other_user}","gists_url":"https://api.github.com/users/fxlb/gists{/gist_id}","starred_url":"https://api.github.com/users/fxlb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fxlb/subscriptions","organizations_url":"https://api.github.com/users/fxlb/orgs","repos_url":"https://api.github.com/users/fxlb/repos","events_url":"https://api.github.com/users/fxlb/events{/privacy}","received_events_url":"https://api.github.com/users/fxlb/received_events","type":"User","site_admin":false},"created_at":"2016-12-23T20:58:09Z","updated_at":"2016-12-23T20:58:09Z","body":"Thanks for the report.\r\nThis issue is now fixed in the security branch (Will be merged in a few weeks).\r\n"}}
{"actor":{"display_login":"fxlb"}}