MEMORY LEAK FOUND AT src/analysis.c

[Rrooach]

Hello, I found a memory leak in /libs7comm/src/analysis.c Below are steps followed to reproduce crash Download latest source code from : /kprovost/libs7comm.git and compiled using ASAN(export CFLAGS="-g -fsanitize=address" CXXFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address" before make)

The problematic code:

 void *dev = cotp_open(argv[1], analyze_receive, NULL, protostack);

ASAN Output:

==8133==ERROR: AddressSanitizer failed to allocate 0x60042000 (1610883072) bytes of LargeMmapAllocator (errno: 12)
==8133==Process memory map follows:
        0x000000400000-0x00000041b000   /root/temp/libs7comm/src/analysis/analyze
        0x00000061a000-0x00000061b000   /root/temp/libs7comm/src/analysis/analyze
        0x00000061b000-0x00000061f000   /root/temp/libs7comm/src/analysis/analyze
        0x00007fff7000-0x00008fff7000
        0x00008fff7000-0x02008fff7000
        0x02008fff7000-0x10007fff8000
        0x600000000000-0x602000000000
        0x602000000000-0x602000010000
        0x602000010000-0x603000000000
        0x603000000000-0x603000010000
        0x603000010000-0x604000000000
        0x604000000000-0x604000010000
        0x604000010000-0x616000000000
        0x616000000000-0x616000020000
        0x616000020000-0x619000000000
        0x619000000000-0x619000020000
        0x619000020000-0x621000000000
        0x621000000000-0x621000020000
        0x621000020000-0x640000000000
        0x640000000000-0x640000003000
        0x7fca89c00000-0x7fca89d00000
        0x7fca89e00000-0x7fca89f00000
        0x7fca89f3b000-0x7fca8c28d000
        0x7fca8c28d000-0x7fca8c2a3000   /lib/x86_64-linux-gnu/libgcc_s.so.1
        0x7fca8c2a3000-0x7fca8c4a2000   /lib/x86_64-linux-gnu/libgcc_s.so.1
        0x7fca8c4a2000-0x7fca8c4a3000   /lib/x86_64-linux-gnu/libgcc_s.so.1
        0x7fca8c4a3000-0x7fca8c5ab000   /lib/x86_64-linux-gnu/libm-2.23.so
        0x7fca8c5ab000-0x7fca8c7aa000   /lib/x86_64-linux-gnu/libm-2.23.so
        0x7fca8c7aa000-0x7fca8c7ab000   /lib/x86_64-linux-gnu/libm-2.23.so
        0x7fca8c7ab000-0x7fca8c7ac000   /lib/x86_64-linux-gnu/libm-2.23.so
        0x7fca8c7ac000-0x7fca8c7af000   /lib/x86_64-linux-gnu/libdl-2.23.so
        0x7fca8c7af000-0x7fca8c9ae000   /lib/x86_64-linux-gnu/libdl-2.23.so
        0x7fca8c9ae000-0x7fca8c9af000   /lib/x86_64-linux-gnu/libdl-2.23.so
        0x7fca8c9af000-0x7fca8c9b0000   /lib/x86_64-linux-gnu/libdl-2.23.so
        0x7fca8c9b0000-0x7fca8c9c8000   /lib/x86_64-linux-gnu/libpthread-2.23.so
        0x7fca8c9c8000-0x7fca8cbc7000   /lib/x86_64-linux-gnu/libpthread-2.23.so
        0x7fca8cbc7000-0x7fca8cbc8000   /lib/x86_64-linux-gnu/libpthread-2.23.so
        0x7fca8cbc8000-0x7fca8cbc9000   /lib/x86_64-linux-gnu/libpthread-2.23.so
        0x7fca8cbc9000-0x7fca8cbcd000
        0x7fca8cbcd000-0x7fca8cd8d000   /lib/x86_64-linux-gnu/libc-2.23.so
        0x7fca8cd8d000-0x7fca8cf8d000   /lib/x86_64-linux-gnu/libc-2.23.so
        0x7fca8cf8d000-0x7fca8cf91000   /lib/x86_64-linux-gnu/libc-2.23.so
        0x7fca8cf91000-0x7fca8cf93000   /lib/x86_64-linux-gnu/libc-2.23.so
        0x7fca8cf93000-0x7fca8cf97000
        0x7fca8cf97000-0x7fca8cfd5000   /usr/lib/x86_64-linux-gnu/libpcap.so.1.7.4
        0x7fca8cfd5000-0x7fca8d1d5000   /usr/lib/x86_64-linux-gnu/libpcap.so.1.7.4
        0x7fca8d1d5000-0x7fca8d1d7000   /usr/lib/x86_64-linux-gnu/libpcap.so.1.7.4
        0x7fca8d1d7000-0x7fca8d1d8000   /usr/lib/x86_64-linux-gnu/libpcap.so.1.7.4
        0x7fca8d1d8000-0x7fca8d1d9000
        0x7fca8d1d9000-0x7fca8d2cd000   /usr/lib/x86_64-linux-gnu/libasan.so.2.0.0
        0x7fca8d2cd000-0x7fca8d4cd000   /usr/lib/x86_64-linux-gnu/libasan.so.2.0.0
        0x7fca8d4cd000-0x7fca8d4d0000   /usr/lib/x86_64-linux-gnu/libasan.so.2.0.0
        0x7fca8d4d0000-0x7fca8d4d1000   /usr/lib/x86_64-linux-gnu/libasan.so.2.0.0
        0x7fca8d4d1000-0x7fca8e146000
        0x7fca8e146000-0x7fca8e16c000   /lib/x86_64-linux-gnu/ld-2.23.so
        0x7fca8e31b000-0x7fca8e35a000
        0x7fca8e35d000-0x7fca8e36b000
        0x7fca8e36b000-0x7fca8e36c000   /lib/x86_64-linux-gnu/ld-2.23.so
        0x7fca8e36c000-0x7fca8e36d000   /lib/x86_64-linux-gnu/ld-2.23.so
        0x7fca8e36d000-0x7fca8e36e000
        0x7ffe78201000-0x7ffe78222000   [stack]
        0x7ffe782e0000-0x7ffe782e3000   [vvar]
        0x7ffe782e3000-0x7ffe782e5000   [vdso]
        0xffffffffff600000-0xffffffffff601000   [vsyscall]
==8133==End of process memory map.
==8133==AddressSanitizer CHECK failed: ../../../../src/libsanitizer/sanitizer_common/sanitizer_posix.cc:121 "(("unable to mmap" && 0)) != (0)" (0x0, 0x0)
    #0 0x7fca8d279631  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa0631)
    #1 0x7fca8d27e5e3 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xa55e3)
    #2 0x7fca8d286611  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xad611)
    #3 0x7fca8d1fbc0c  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22c0c)
    #4 0x7fca8d2715d2 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x985d2)
    #5 0x7fca8cfb652e  (/usr/lib/x86_64-linux-gnu/libpcap.so.0.8+0x1f52e)
    #6 0x7fca8cfb5c78 in pcap_fopen_offline_with_tstamp_precision (/usr/lib/x86_64-linux-gnu/libpcap.so.0.8+0x1ec78)
    #7 0x7fca8cfb5ddc in pcap_open_offline_with_tstamp_precision (/usr/lib/x86_64-linux-gnu/libpcap.so.0.8+0x1eddc)
    #8 0x402604 in pcap__open analysis/pcap.c:34                                                                                                #9 0x412122 in tpkt_open lib/tpkt.c:80                                                                                                      #10 0x413ae0 in cotp_open lib/cotp.c:188                                                                                                    #11 0x40188b in main analysis/analyze.c:343                                                                                                 #12 0x7fca8cbed82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)                                                           #13 0x401e38 in _start (/root/temp/libs7comm/src/analysis/analyze+0x401e38) 

[kprovost]

The error message seems to suggest that the (presumably libasan-ified) malloc() didn't want to allocate 1610883072 bytes (1.6 GB). The analysis tool opens a pcap file if I remember correctly. How big is that file?

My current theory is that you're feeding it a very large file which makes asan unhappy, rather than there being a leak.

[wuyxiquanquan]

crash.zip here is the crash data, you might want to check it out.