Panic during parsing of message

[thomaseizinger]

We received a crash report from our application where the stacktrace points into netlink-packet-route:

OS Version: Linux 4.4.0-210-generic (None)
Report Version: 104


Application Specific Information:
range end index 96 out of range for slice of length 92

Thread 0 Crashed:
0   std                             0x7fd413851989      std::sys::backtrace::__rust_end_short_backtrace
1   <unknown>                       0x7fd41385197c      rust_begin_unwind
2   core                            0x7fd4131fe24f      core::panicking::panic_fmt
3   core                            0x7fd4131fe2b6      core::slice::index::slice_end_index_len_fail
4   netlink_packet_route            0x7fd41355e7b3      netlink_packet_route::link::message::LinkMessage::parse
5   netlink_packet_route            0x7fd41357386d      netlink_packet_route::message::RouteNetlinkMessage::parse_with_param
6   netlink_proto                   0x7fd41341e0f0      netlink_proto::connection::Connection<T>::poll
7   tokio                           0x7fd41341c872      tokio::runtime::task::raw::poll
8   firezone_gateway                0x7fd41333d539      firezone_gateway::main
9   std                             0x7fd4132867a6      std::sys::backtrace::__rust_begin_short_backtrace
10  <unknown>                       0x7fd41334c889      main

I haven't yet found the code that actually panics here because I am not familiar with the codebase and how the buffers get indexed.

[cathay4t]

Is that possible for you to get a reproducer?

[thomaseizinger]

Unfortunately not yet. We only received two reports. Both of them are for Linux 4.4.0-210-generic so a quite old Linux version.

[cathay4t]

We have expand_buffer_if_small() to expand the buffer if that is too small in order to support old kernels.

But I am not 100% we use it for all the buffer parsing, need some time to check.

Can you tell me the version of netlink-packet-route you are using?

[thomaseizinger]

Can you tell me the version of netlink-packet-route you are using?

0.19.0 !

[cathay4t]

We changed a lot since that version. Could try again with 0.24.0 or later?

[thomaseizinger]

We changed a lot since that version. Could try again with 0.24.0 or later?

We have already upgraded yes. Unfortunately, we were not able to reproduce this beyond the automated crash report that we received from a customer's machine. If it happens again with the latest release, I'll let you know.