Description of Problem:
tcpdump reliably segfaults when displaying NFS traffic.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Run tcpdump
2. Cause lots of NFS traffic.
3. Watch tcpdump segfault when trying to display it.
4. Craft exploit.
I'll attach three files. A strace of a segfaulting tcpdump run, the output
from that run, and a packet trace from ethereal at the same time on the
Created attachment 35182 [details]
Created attachment 35183 [details]
Created attachment 35184 [details]
output of tcpdump when it died
Have confirmed that 'tcpdump -r tcpdump-death-ethereal-capture' also dies, and I
can actually get a core dump that way.
#0 0x08062340 in strcpy ()
#1 0x080912a9 in _IO_stdin_used () at eval.c:41
#2 0x08054cd6 in strcpy ()
#3 0x08054ed2 in strcpy ()
#4 0x08052734 in strcpy ()
#5 0x080501fd in strcpy ()
#6 0x08050013 in strcpy ()
#7 0x0807ffad in error () at eval.c:41
#8 0x08077676 in error () at eval.c:41
#9 0x0804aad9 in strcpy ()
#10 0x4011e627 in __libc_start_main (main=0x804a210 <strcpy+552>, argc=3,
ubp_av=0xbffff814, init=0x8049940 <_init>, fini=0x80838e0 <_fini>,
rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbffff80c)
thx for the extensive investigation :)
can you please retry with 3.6.2-10?
tcpdump-3.6.2-10.7x still segfaults on i386. Does it not do the same for you
when you do 'tcpdump -r tcpdump-death-ethereal-capture' with the file above?
fixed in 3.6.2-12
An errata has been issued which should help the problem described in this bug report.
This report is therefore being closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, please follow the link below. You may reopen
this bug report if the solution does not work for you.