forked from Mirror/frr
7bd03cf378
```
ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000aecf0 at pc 0x5555557ecdb9 bp 0x7fffffffe350 sp 0x7fffffffe340
READ of size 4 at 0x6160000aecf0 thread T0
#0 0x5555557ecdb8 in igmp_source_delete pimd/pim_igmpv3.c:340
#1 0x5555557ed475 in igmp_source_delete_expired pimd/pim_igmpv3.c:405
#2 0x5555557de574 in igmp_group_timer pimd/pim_igmp.c:1346
#3 0x7ffff7275421 in event_call lib/event.c:1996
#4 0x7ffff7140797 in frr_run lib/libfrr.c:1237
#5 0x5555557f5840 in main pimd/pim_main.c:166
#6 0x7ffff6a54082 in __libc_start_main ../csu/libc-start.c:308
#7 0x555555686eed in _start (/usr/lib/frr/pimd+0x132eed)
0x6160000aecf0 is located 112 bytes inside of 600-byte region [0x6160000aec80,0x6160000aeed8)
freed by thread T0 here:
#0 0x7ffff767b40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x7ffff716ed34 in qfree lib/memory.c:131
#2 0x5555557169ae in pim_channel_oil_free pimd/pim_oil.c:84
#3 0x555555717981 in pim_channel_oil_del pimd/pim_oil.c:199
#4 0x55555573c42c in tib_sg_gm_prune pimd/pim_tib.c:196
#5 0x5555557d6d04 in igmp_source_forward_stop pimd/pim_igmp.c:229
#6 0x5555557d5855 in igmp_anysource_forward_stop pimd/pim_igmp.c:61
#7 0x5555557de539 in igmp_group_timer pimd/pim_igmp.c:1344
#8 0x7ffff7275421 in event_call lib/event.c:1996
#9 0x7ffff7140797 in frr_run lib/libfrr.c:1237
#10 0x5555557f5840 in main pimd/pim_main.c:166
#11 0x7ffff6a54082 in __libc_start_main ../csu/libc-start.c:308
previously allocated by thread T0 here:
#0 0x7ffff767ba06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153
#1 0x7ffff716ebe1 in qcalloc lib/memory.c:106
#2 0x555555716eb7 in pim_channel_oil_add pimd/pim_oil.c:133
#3 0x55555573b2b9 in tib_sg_oil_setup pimd/pim_tib.c:30
#4 0x55555573bdd3 in tib_sg_gm_join pimd/pim_tib.c:119
#5 0x5555557d6788 in igmp_source_forward_start pimd/pim_igmp.c:193
#6 0x5555557d5771 in igmp_anysource_forward_start pimd/pim_igmp.c:51
#7 0x5555557ecaa0 in group_exclude_fwd_anysrc_ifempty pimd/pim_igmpv3.c:310
#8 0x5555557ef937 in toex_incl pimd/pim_igmpv3.c:839
#9 0x5555557f00a2 in igmpv3_report_toex pimd/pim_igmpv3.c:938
#10 0x5555557f543d in igmp_v3_recv_report pimd/pim_igmpv3.c:2000
#11 0x5555557da2b4 in pim_igmp_packet pimd/pim_igmp.c:787
#12 0x5555556ee46a in process_igmp_packet pimd/pim_mroute.c:763
#13 0x5555556ee5f3 in pim_mroute_msg pimd/pim_mroute.c:787
#14 0x5555556eef58 in mroute_read pimd/pim_mroute.c:877
#15 0x7ffff7275421 in event_call lib/event.c:1996
#16 0x7ffff7140797 in frr_run lib/libfrr.c:1237
#17 0x5555557f5840 in main pimd/pim_main.c:166
#18 0x7ffff6a54082 in __libc_start_main ../csu/libc-start.c:308
SUMMARY: AddressSanitizer: heap-use-after-free pimd/pim_igmpv3.c:340 in igmp_source_delete
Shadow bytes around the buggy address:
0x0c2c8000dd40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c8000dd50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c8000dd60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c8000dd70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c8000dd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2c8000dd90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd
0x0c2c8000dda0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c8000ddb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c8000ddc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c2c8000ddd0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
0x0c2c8000dde0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
```
Signed-off-by: Jafar Al-Gharaibeh <jafar@atcorp.com>
|
||
|---|---|---|
| .. | ||
| .gitignore | ||
| AUTHORS | ||
| CAVEATS | ||
| COMMANDS | ||
| DEBUG | ||
| LINUX_KERNEL_MROUTE_MFC | ||
| Makefile | ||
| mtracebis.c | ||
| mtracebis_netlink.c | ||
| mtracebis_netlink.h | ||
| mtracebis_routeget.c | ||
| mtracebis_routeget.h | ||
| pim6_cmd.c | ||
| pim6_cmd.h | ||
| pim6_main.c | ||
| pim6_mld.c | ||
| pim6_mld.h | ||
| pim6_mld_protocol.h | ||
| pim_addr.c | ||
| pim_addr.h | ||
| pim_assert.c | ||
| pim_assert.h | ||
| pim_autorp.c | ||
| pim_autorp.h | ||
| pim_bfd.c | ||
| pim_bfd.h | ||
| pim_bsm.c | ||
| pim_bsm.h | ||
| pim_bsr_rpdb.c | ||
| pim_cmd.c | ||
| pim_cmd.h | ||
| pim_cmd_common.c | ||
| pim_cmd_common.h | ||
| pim_errors.c | ||
| pim_errors.h | ||
| pim_hello.c | ||
| pim_hello.h | ||
| pim_iface.c | ||
| pim_iface.h | ||
| pim_ifchannel.c | ||
| pim_ifchannel.h | ||
| pim_igmp.c | ||
| pim_igmp.h | ||
| pim_igmp_join.h | ||
| pim_igmp_mtrace.c | ||
| pim_igmp_mtrace.h | ||
| pim_igmp_stats.c | ||
| pim_igmp_stats.h | ||
| pim_igmpv2.c | ||
| pim_igmpv2.h | ||
| pim_igmpv3.c | ||
| pim_igmpv3.h | ||
| pim_instance.c | ||
| pim_instance.h | ||
| pim_int.c | ||
| pim_int.h | ||
| pim_join.c | ||
| pim_join.h | ||
| pim_jp_agg.c | ||
| pim_jp_agg.h | ||
| pim_macro.c | ||
| pim_macro.h | ||
| pim_main.c | ||
| pim_memory.c | ||
| pim_memory.h | ||
| pim_mlag.c | ||
| pim_mlag.h | ||
| pim_mroute.c | ||
| pim_mroute.h | ||
| pim_msdp.c | ||
| pim_msdp.h | ||
| pim_msdp_packet.c | ||
| pim_msdp_packet.h | ||
| pim_msdp_socket.c | ||
| pim_msdp_socket.h | ||
| pim_msg.c | ||
| pim_msg.h | ||
| pim_nb.c | ||
| pim_nb.h | ||
| pim_nb_config.c | ||
| pim_neighbor.c | ||
| pim_neighbor.h | ||
| pim_nht.c | ||
| pim_nht.h | ||
| pim_oil.c | ||
| pim_oil.h | ||
| pim_pim.c | ||
| pim_pim.h | ||
| pim_register.c | ||
| pim_register.h | ||
| pim_routemap.c | ||
| pim_rp.c | ||
| pim_rp.h | ||
| pim_rpf.c | ||
| pim_rpf.h | ||
| pim_signals.c | ||
| pim_signals.h | ||
| pim_sock.c | ||
| pim_sock.h | ||
| pim_ssm.c | ||
| pim_ssm.h | ||
| pim_ssmpingd.c | ||
| pim_ssmpingd.h | ||
| pim_static.c | ||
| pim_static.h | ||
| pim_str.h | ||
| pim_tib.c | ||
| pim_tib.h | ||
| pim_time.c | ||
| pim_time.h | ||
| pim_tlv.c | ||
| pim_tlv.h | ||
| pim_upstream.c | ||
| pim_upstream.h | ||
| pim_util.c | ||
| pim_util.h | ||
| pim_vty.c | ||
| pim_vty.h | ||
| pim_vxlan.c | ||
| pim_vxlan.h | ||
| pim_vxlan_instance.h | ||
| pim_zebra.c | ||
| pim_zebra.h | ||
| pim_zlookup.c | ||
| pim_zlookup.h | ||
| pim_zpthread.c | ||
| pimd.c | ||
| pimd.h | ||
| README | ||
| subdir.am | ||
| test_igmpv3_join.c | ||
| TODO | ||
| TROUBLESHOOTING | ||
INTRODUCTION
qpimd aims to implement a PIM (Protocol Independent Multicast)
daemon for the FRR Routing Suite.
qpimd implements PIM-SM (Sparse Mode) of RFC 4601.
Additionally MSDP has been implemented.
In order to deliver end-to-end multicast routing control
plane, qpimd includes the router-side of IGMPv[2|3] (RFC 3376).
LICENSE
qpimd - pimd for FRR
Copyright (C) 2008 Everton da Silva Marques
qpimd is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as
published by the Free Software Foundation; either version 2,
or (at your option) any later version.
qpimd is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public
License along with qpimd; see the file COPYING. If not, write
to the Free Software Foundation, Inc., 59 Temple Place - Suite
330, Boston, MA 02111-1307, USA.
HOME SITE
qpimd lives at:
https://github.com/frrouting/frr
PLATFORMS
qpimd has been tested with Debian Jessie.
REQUIREMENTS
qpimd requires FRR (2.0 or higher)
CONFIGURATION COMMANDS
See available commands in the file pimd/COMMANDS.
KNOWN CAVEATS
See list of known caveats in the file pimd/CAVEATS.
SUPPORT
Please post comments, questions, patches, bug reports at the
support site:
https://frrouting.org/frr
RELATED WORK
igmprt: An IGMPv3-router implementation
- http://www.loria.fr/~lahmadi/igmpv3-router.html
USC pimd: PIMv2-SM daemon
- http://netweb.usc.edu/pim/pimd (URL broken in 2008-12-23)
- http://packages.debian.org/source/sid/pimd (from Debian)
troglobit pimd: This is the original USC pimd from
http://netweb.usc.edu/pim/. In January 16, 2010 it was revived
with the intention to collect patches floating around in
Debian, Gentoo, Lintrack and other distribution repositories
and to provide a central point of collaboration.
- http://github.com/troglobit/pimd
zpimd: zpimd is not dependent of zebra or any other routing daemon
- ftp://robur.slu.se/pub/Routing/Zebra
- http://sunsite2.icm.edu.pl/pub/unix/routing/zpimd
mrd6: an IPv6 Multicast Router for Linux systems
- http://fivebits.net/proj/mrd6/
MBGP: Implementation of RFC 2858 for Quagga
- git://git.coplanar.net/~balajig/quagga
- http://www.gossamer-threads.com/lists/quagga/dev/18000
REFERENCES
IANA Protocol Independent Multicast (PIM) Parameters
http://www.iana.org/assignments/pim-parameters/pim-parameters.txt
Address Family Numbers
http://www.iana.org/assignments/address-family-numbers
-- END --