Ettercap/ettercap — pull request #119 by jacob-baines (2013-03-14 01:37:35+00:00)
Title: o5logon Heap Corruption

OS: Ubunt 12.10 32 bit
Ettercap Version: Almost master (28bfb2dee328bbbc39fd69768a8f4af92cd9ed15)
File: https://www.wireshark.org/download/automated/captures/fuzz-2009-06-26-23834.pcap
Description:
The above capture causes heap corruption due to writing off of the end of an allocated structure.

CLI Output
*** glibc detected *** ettercap: malloc(): memory corruption: 0xb4c0ec70 ***

Valgrind Output

==4454== Invalid write of size 1
==4454== at 0x402C538: strncpy (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==4454== by 0x807E59F: dissector_o5logon (ec_o5logon.c:100)
==4454== by 0x8059CF0: decode_data (ec_decode.c:304)
==4454== by 0x808BD5B: decode_tcp (ec_tcp.c:295)

... snip ...

valgrind: m_mallocfree.c:266 (mk_plain_bszB): Assertion 'bszB != 0' failed.
valgrind: This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata. If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away. Please try that before reporting this as a bug.

Fix
Added a length check to make sure we don't overwrite the size of buffer. Retested with the captures listed here: https://github.com/Ettercap/ettercap/pull/19

Note that the original capture also has invalid reads in Napster that I (or someone) should get to at some point.