Heap-buffer-overflow in ipv4_header_len.

google / packetdrill

The official Google release of packetdrill

GNU General Public License v2.0

887 stars 220 forks source link

Heap-buffer-overflow in ipv4_header_len. #63

Closed koltiradw closed 1 year ago

koltiradw commented 2 years ago

Hi! I found heap-buffer-overflow ( occurs at net/packetdrill/ip.h:99 ) during testing with libFuzzer. Perhaps to fix the error, you can try to change the code in net/packetdrill/packet_parser.c:211 to struct ipv4 *ipv4 = (struct ipv4 *) malloc(sizeof(struct ipv4)); memcpy(ipv4, header_start, sizeof(struct ipv4));

Harness for libfuzzer and crash file: artifacts.zip

nealcardwell commented 1 year ago

Sorry I did not see this issue until now. Can you please clarify what the problem is and why you closed this issue? Thanks!