{"action":"closed","issue":{"url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/553","repository_url":"https://api.github.com/repos/the-tcpdump-group/libpcap","labels_url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/553/labels{/name}","comments_url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/553/comments","events_url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/553/events","html_url":"https://github.com/the-tcpdump-group/libpcap/issues/553","id":205722826,"number":553,"title":"use-after-free on ebuf when interface does not exist in Linux","user":{"login":"infrastation","id":900115,"avatar_url":"https://avatars.githubusercontent.com/u/900115?v=3","gravatar_id":"","url":"https://api.github.com/users/infrastation","html_url":"https://github.com/infrastation","followers_url":"https://api.github.com/users/infrastation/followers","following_url":"https://api.github.com/users/infrastation/following{/other_user}","gists_url":"https://api.github.com/users/infrastation/gists{/gist_id}","starred_url":"https://api.github.com/users/infrastation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/infrastation/subscriptions","organizations_url":"https://api.github.com/users/infrastation/orgs","repos_url":"https://api.github.com/users/infrastation/repos","events_url":"https://api.github.com/users/infrastation/events{/privacy}","received_events_url":"https://api.github.com/users/infrastation/received_events","type":"User","site_admin":false},"labels":[{"id":59205714,"url":"https://api.github.com/repos/the-tcpdump-group/libpcap/labels/bug","name":"bug","color":"e11d21","default":true},{"id":533625319,"url":"https://api.github.com/repos/the-tcpdump-group/libpcap/labels/found%20in%201.8.x","name":"found in 1.8.x","color":"ededed","default":false},{"id":59205677,"url":"https://api.github.com/repos/the-tcpdump-group/libpcap/labels/runtime","name":"runtime","color":"f7c6c7","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-02-06T22:09:19Z","updated_at":"2017-02-06T23:49:51Z","closed_at":"2017-02-06T23:49:51Z","body":"Not a big issue but it looks like `pcap_close()` somehow deallocates tcpdump's error buffer, tcpdump reasonably doesn't expect that and upon trying to use the buffer again triggers AddressSanitizer. I tried to look through briefly but could not see how exactly it happens so decided to file here before I forget about it.\r\n```\r\ntcpdump version 4.10.0-PRE-GIT_2017_02_06\r\nlibpcap version 1.9.0-PRE-GIT_2017_02_06\r\nOpenSSL 1.0.2g  1 Mar 2016\r\nCompiled with AddressSanitizer/GCC.\r\n\r\n# ~denis/tcpdump/tcpdump -ni abcdefg\r\n=================================================================\r\n==14868==ERROR: AddressSanitizer: heap-use-after-free on address 0x61800000fd50 at pc 0x7f5011e961e9 bp 0x7ffef7357ec0 sp 0x7ffef7357638\r\nREAD of size 30 at 0x61800000fd50 thread T0\r\n    #0 0x7f5011e961e8  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x601e8)\r\n    #1 0x7f5011e97145 in __interceptor_vsnprintf (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x61145)\r\n    #2 0x7f5011e973b1 in snprintf (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x613b1)\r\n    #3 0x40620a in open_interface tcpdump.c:1088\r\n    #4 0x408835 in main tcpdump.c:1717\r\n    #5 0x7f501164982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n    #6 0x4039a8 in _start (/home/denis/tcpdump/tcpdump+0x4039a8)\r\n\r\n0x61800000fd50 is located 208 bytes inside of 776-byte region [0x61800000fc80,0x61800000ff88)\r\nfreed by thread T0 here:\r\n    #0 0x7f5011ece2ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)\r\n    #1 0x58da86 in pcap_close pcap.c:2839\r\n    #2 0x4061d1 in open_interface tcpdump.c:1087\r\n    #3 0x408835 in main tcpdump.c:1717\r\n    #4 0x7f501164982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n\r\npreviously allocated by thread T0 here:\r\n    #0 0x7f5011ece602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)\r\n    #1 0x58a134 in pcap_alloc_pcap_t pcap.c:1256\r\n    #2 0x58a2f7 in pcap_create_common pcap.c:1293\r\n    #3 0x5d357e in pcap_create_interface pcap-linux.c:462\r\n    #4 0x589dfe in pcap_create pcap.c:1187\r\n    #5 0x405db7 in open_interface tcpdump.c:1002\r\n    #6 0x408835 in main tcpdump.c:1717\r\n    #7 0x7f501164982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n\r\nSUMMARY: AddressSanitizer: heap-use-after-free ??:0 ??\r\nShadow bytes around the buggy address:\r\n  0x0c307fff9f50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c307fff9f60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c307fff9f70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c307fff9f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c307fff9f90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n=>0x0c307fff9fa0: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd\r\n  0x0c307fff9fb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0c307fff9fc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0c307fff9fd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0c307fff9fe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0c307fff9ff0: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n==14868==ABORTING\r\n```"}}
{"actor":{"display_login":"guyharris"}}