{"action":"created","issue":{"url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/446","labels_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/446/labels{/name}","comments_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/446/comments","events_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/446/events","html_url":"https://github.com/the-tcpdump-group/tcpdump/issues/446","id":64336733,"number":446,"title":"Possible heap overflows reading pcap","user":{"login":"brandonprry","id":483180,"avatar_url":"https://avatars.githubusercontent.com/u/483180?v=3","gravatar_id":"","url":"https://api.github.com/users/brandonprry","html_url":"https://github.com/brandonprry","followers_url":"https://api.github.com/users/brandonprry/followers","following_url":"https://api.github.com/users/brandonprry/following{/other_user}","gists_url":"https://api.github.com/users/brandonprry/gists{/gist_id}","starred_url":"https://api.github.com/users/brandonprry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brandonprry/subscriptions","organizations_url":"https://api.github.com/users/brandonprry/orgs","repos_url":"https://api.github.com/users/brandonprry/repos","events_url":"https://api.github.com/users/brandonprry/events{/privacy}","received_events_url":"https://api.github.com/users/brandonprry/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-03-25T18:10:04Z","updated_at":"2015-03-25T22:43:53Z","closed_at":null,"body":"Hello,\r\n\r\nIn learning how to use american fuzzy lop, I decided to make libpcap/tcpdump my first fuzzing foray. I was able to find two possible heap overflows in print-wb.c (lines 274 and 280).\r\n\r\nLoading tcpdump (4.7.3) in gdb and running the two testcases that consistently segfault:\r\n\r\ngdb ../../tcpdump-4.7.3/tcpdump\r\n\r\n```\r\nrun -ntr id:000003,sig:11,src:005130,op:int32,pos:16,val:+64 \r\n \r\nProgram received signal SIGSEGV, Segmentation fault.\r\nwb_prep (len=<optimized out>, prep=<optimized out>, ndo=0xcf82a0 <Gndo>)\r\n    at ./print-wb.c:274\r\n274\t\t\tND_PRINT((ndo, \" %u/%s:%u\",\r\n```\r\n\r\nAnd...\r\n\r\n```\r\nrun -r id:000000,sig:11,src:004852,op:flip1,pos:92 \r\n \r\nProgram received signal SIGSEGV, Segmentation fault.\r\nwb_prep (len=<optimized out>, prep=<optimized out>, ndo=0xcf82a0 <Gndo>)\r\n    at ./print-wb.c:280\r\n280\t\t\t\tND_PRINT((ndo, \"%c%s:%u\", c, ipaddr_string(ndo, &io->id),\r\n```\r\n\r\nWhat would be the best way to get the testcases to you that cause the crashes?\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/comments/86241192","html_url":"https://github.com/the-tcpdump-group/tcpdump/issues/446#issuecomment-86241192","issue_url":"https://api.github.com/repos/the-tcpdump-group/tcpdump/issues/446","id":86241192,"user":{"login":"infrastation","id":900115,"avatar_url":"https://avatars.githubusercontent.com/u/900115?v=3","gravatar_id":"","url":"https://api.github.com/users/infrastation","html_url":"https://github.com/infrastation","followers_url":"https://api.github.com/users/infrastation/followers","following_url":"https://api.github.com/users/infrastation/following{/other_user}","gists_url":"https://api.github.com/users/infrastation/gists{/gist_id}","starred_url":"https://api.github.com/users/infrastation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/infrastation/subscriptions","organizations_url":"https://api.github.com/users/infrastation/orgs","repos_url":"https://api.github.com/users/infrastation/repos","events_url":"https://api.github.com/users/infrastation/events{/privacy}","received_events_url":"https://api.github.com/users/infrastation/received_events","type":"User","site_admin":false},"created_at":"2015-03-25T22:43:53Z","updated_at":"2015-03-25T22:43:53Z","body":"Thank you. I confirm a segfault for each case (both with `-ntr`), the 1st one takes longer to crash and the 2nd is almost instant. I am working on this."}}