node_pcap icon indicating copy to clipboard operation
node_pcap copied to clipboard

decode.packet creates stack overflow

Open DanielBaulig opened this issue 14 years ago • 4 comments

I am performing some performance measurements on node pcap and ecountered a critical bug. I am not entirely sure what the payload is that produces the bug, but any malformed (ip6?) header that cannot be parsed by decode.ip6_header should theoretically produce this bug.

Calling decode.packet on a malformed ip6 packet will result in decode.ip6_header beeing called recursivly. As soon as raw_packet[offset] produces undefined (which it will eventually) all hell breaks loose and the recursion will continue until a stack overflow occurs. decode.ip6_header should check if offset is a valid value and return if it isn't.

DanielBaulig avatar Jun 16 '11 09:06 DanielBaulig

I just realized that the recursive call is also missing the ip parameter, which could produce the bug all by itself. Infact adding ip though doesn't fix the bug, so the offset problem needs to be fixed aswell.

DanielBaulig avatar Jun 16 '11 09:06 DanielBaulig

See this gist for a potential fix: https://gist.github.com/1028939

DanielBaulig avatar Jun 16 '11 09:06 DanielBaulig

The suggested fix does not actually stop the bug from occuring. I am not sure what else could cause the stack overflow though. I will see if I can gather some additional information.

DanielBaulig avatar Jun 16 '11 09:06 DanielBaulig

Ok, yet another attempt at fixing the issue, I think I finally got it this time: https://gist.github.com/1028939

DanielBaulig avatar Jun 16 '11 10:06 DanielBaulig