Project: libiec61850 (mz-automation/libiec61850), language: c++
Vulnerability instance: libiec61850.cve-2019-1010300
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/mz-automation/libiec61850/issues/127
## Description:
Issue: mz-automation/libiec61850#127
Title: negative-size-param in server_example_ca.c
State: closed
Created by: HopefulWei
Created at: 2019-02-25 13:26:26+00:00

Issue Body:
Hi team,

Their are negative-size-param in `server_example_ca.c`
libIEC61850 1.3.0 1.3.1 1.3.2 version has this problem.
Snip **[server_example_ca.c](https://github.com/mz-automation/libiec61850/blob/v1.3/examples/server_example_complex_array/server_example_ca.c)**

```
==2158==ERROR: AddressSanitizer: negative-size-param: (size=-1)
    #0 0x45825b  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x45825b)
    #1 0x52cc98  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x52cc98)
    #2 0x52cdcc  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x52cdcc)
    #3 0x52ce1a  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x52ce1a)
    #4 0x5130d8  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x5130d8)
    #5 0x5139d4  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x5139d4)
    #6 0x4f2adc  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x4f2adc)
    #7 0x7f97959016b9  (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #8 0x7f9794d0c41c  (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

0x625000007907 is located 7 bytes inside of 8196-byte region [0x625000007900,0x625000009904)
allocated by thread T1 here:
    #0 0x4b9088  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x4b9088)
    #1 0x4f2c9d  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x4f2c9d)
    #2 0x513ad8  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x513ad8)
    #3 0x512722  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x512722)
    #4 0x51287d  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x51287d)
    #5 0x7f97959016b9  (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Thread T4 created by T1 here:
    #0 0x42b499  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x42b499)
    #1 0x4f2b28  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x4f2b28)
    #2 0x513c7e  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x513c7e)
    #3 0x512722  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x512722)
    #4 0x51287d  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x51287d)
    #5 0x7f97959016b9  (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Thread T1 created by T0 here:
    #0 0x42b499  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x42b499)
    #1 0x4f2b61  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x4f2b61)
    #2 0x512a7e  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x512a7e)
    #3 0x4f619d  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x4f619d)
    #4 0x4f1470  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x4f1470)
    #5 0x4ea90b  (/home/gw/share/libiec61850-1.3/examples/server_example_complex_array/server_example_ca+0x4ea90b)
    #6 0x7f9794c2582f  (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
```


Comments:
Comment by mzillgith on 2019-02-26 10:42:55+00:00:
Hi,
Not sure what that means.
How can I reproduce this?

---

Comment by HopefulWei on 2019-02-26 11:03:09+00:00:
> Hi,
> Not sure what that means.
> How can I reproduce this?

You can reproduce it by continuously sending MMS packets to the server. In fact, it is fuzzing。

---

Comment by mzillgith on 2019-02-26 11:06:47+00:00:
Can you create stack more expressive stack traces (with source line information)?

---

Comment by HopefulWei on 2019-02-26 11:18:54+00:00:
OK，I will.
The problematic code is on lines 100 and 101.
```
 while (running) {
                Thread_sleep(1000);
```
ASAN’s error is
```
root@90900a8541e8:/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array# ./server_example_ca
=================================================================
==2503==ERROR: AddressSanitizer: negative-size-param: (size=-1)
    #0 0x45825b  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x45825b)
    #1 0x52d064  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x52d064)
    #2 0x52d198  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x52d198)
    #3 0x52d1e6  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x52d1e6)
    #4 0x513441  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x513441)
    #5 0x513d3d  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x513d3d)
    #6 0x4f2b3a  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x4f2b3a)
    #7 0x7ff39d3b16b9  (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #8 0x7ff39c7bc41c  (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

0x625000007907 is located 7 bytes inside of 8196-byte region [0x625000007900,0x625000009904)
allocated by thread T1 here:
    #0 0x4b9088  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x4b9088)
    #1 0x4f2cfb  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x4f2cfb)
    #2 0x513e41  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x513e41)
    #3 0x512a8b  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x512a8b)
    #4 0x512be6  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x512be6)
    #5 0x7ff39d3b16b9  (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Thread T4 created by T1 here:
    #0 0x42b499  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x42b499)
    #1 0x4f2b86  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x4f2b86)
    #2 0x513fe7  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x513fe7)
    #3 0x512a8b  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x512a8b)
    #4 0x512be6  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x512be6)
    #5 0x7ff39d3b16b9  (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)

Thread T1 created by T0 here:
    #0 0x42b499  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x42b499)
    #1 0x4f2bbf  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x4f2bbf)
    #2 0x512de7  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x512de7)
    #3 0x4f61fb  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x4f61fb)
    #4 0x4f14ce  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x4f14ce)
    #5 0x4ea90b  (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x4ea90b)
    #6 0x7ff39c6d582f  (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: negative-size-param (/home/gw/share/libiec61850-1.3.2/examples/server_example_complex_array/server_example_ca+0x45825b) 
==2503==ABORTING
```

---

Comment by HopefulWei on 2019-02-26 11:24:48+00:00:
[CVE-2016-4073](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4073) has the same problem.

---

Comment by mzillgith on 2019-02-26 11:35:34+00:00:
` while (running) {
                Thread_sleep(1000);`

That makes not so much sense. The problem has to be in another thread where the MMS messages are processed.

---

Comment by HopefulWei on 2019-02-26 13:06:48+00:00:
The problem code I am targeting is indeed
```
while (running) { Thread_sleep(1000);
```
I don't know if you have any good code debugging methods.

---

Comment by mzillgith on 2019-02-26 14:23:37+00:00:
I don't understand why you think there is a problem when calling
`Thread_sleep(1000);`
That would mean there is a problem in glibc.

---

Comment by mzillgith on 2019-03-01 11:06:51+00:00:
duplicate (see #128)

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build && cd build
cmake ../
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN git clone https://github.com/mz-automation/libiec61850 libiec61850
RUN git -C libiec61850 checkout edc093e810f375bc1de04511592c09e01fb76e82
WORKDIR $SRC/libiec61850
COPY build.sh $SRC/

Additional files:
filename: fuzz_decode.options
content: [libfuzzer]
detect_leaks=0