Project: libiec61850 (mz-automation/libiec61850), language: c++
Vulnerability instance: libiec61850.cve-2019-6136
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/mz-automation/libiec61850/issues/105
## Description:
Issue: mz-automation/libiec61850#105
Title: SEGV in sv_subscriber.c
State: closed
Created by: RootUp
Created at: 2019-01-11 12:36:38+00:00

Issue Body:
Hi team, 

SEGV fault in `sv_subscriber.c`

Snip **[sv_subscriber.c](https://github.com/mz-automation/libiec61850/blob/v1.3/src/sampled_values/sv_subscriber.c#L186)**
```
        Thread_start(thread);
    }
    else {
        if (DEBUG_SV_SUBSCRIBER)
            printf("SV_SUBSCRIBER: Starting SV receiver failed for interface %s\n", self->interfaceId);
    }
}
```

## SEGV
```
Using interface eth0
Error creating raw socket!
ASAN:DEADLYSIGNAL
=================================================================
==1403==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x55b5675c1284 bp 0x7f92623fee30 sp 0x7f92623fee20 T1)
==1403==The signal is caused by a WRITE memory access.
==1403==Hint: address points to the zero page.
    #0 0x55b5675c1283 in Ethernet_setProtocolFilter /home/input0/Desktop/libiec61850/hal/ethernet/linux/ethernet_linux.c:209
    #1 0x55b5675ba75f in SVReceiver_startThreadless /home/input0/Desktop/libiec61850/src/sampled_values/sv_subscriber.c:232
    #2 0x55b5675ba3b7 in svReceiverLoop /home/input0/Desktop/libiec61850/src/sampled_values/sv_subscriber.c:163
    #3 0x55b5675c1720 in destroyAutomaticThread /home/input0/Desktop/libiec61850/hal/thread/linux/thread_linux.c:90
    #4 0x7f9265c976da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #5 0x7f92659c088e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/input0/Desktop/libiec61850/hal/ethernet/linux/ethernet_linux.c:209 in Ethernet_setProtocolFilter
Thread T1 created by T0 here:
    #0 0x7f9265ee6d2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
    #1 0x55b5675c17ab in Thread_start /home/input0/Desktop/libiec61850/hal/thread/linux/thread_linux.c:101
    #2 0x55b5675ba49a in SVReceiver_start /home/input0/Desktop/libiec61850/src/sampled_values/sv_subscriber.c:186
    #3 0x55b5675b9eec in main /home/input0/Desktop/libiec61850/examples/sv_subscriber/sv_subscriber_example.c:76
    #4 0x7f92658c0b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

==1403==ABORTING
```


Comments:
Comment by stv0g on 2019-01-12 21:21:52+00:00:
Hi @RootUp,

why do you believe this is caused by a memory leak? To me this looks more like a segmentation fault.
Can you provide a simple example code or call stack for debugging?

---

Comment by stv0g on 2019-01-12 21:24:14+00:00:
Most likely, this is a duplicate of #86.

---

Comment by abergmann on 2019-01-14 07:32:42+00:00:
[CVE-2019-6136](https://nvd.nist.gov/vuln/detail/CVE-2019-6136) got assigned to this issue.

---

Comment by mzillgith on 2019-01-14 08:00:42+00:00:
Duplicate. Reason already explained in #86

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build && cd build
cmake ../
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN git clone https://github.com/mz-automation/libiec61850 libiec61850
RUN git -C libiec61850 checkout edc093e810f375bc1de04511592c09e01fb76e82
WORKDIR $SRC/libiec61850
COPY build.sh $SRC/

Additional files:
filename: fuzz_decode.options
content: [libfuzzer]
detect_leaks=0