NFD » ndn-cxx

FreshnessPeriod is defined as a NonNegativeInteger in NDN protocol. ndn-cxx's decoding routines for NNI return a uint64_t type. In MetaInfo::wireDecode however, the uint64_t is converted to time::milliseconds, which is a signed type and therefore cannot represent the whole range of uint64_t numbers. This operation has implementation-defined behavior in C++. Typically, large values cause a wraparound and the result becomes negative. Most, if not all, other code in the library and NFD is not prepared to handle a negative FreshnessPeriod, thus causing all sorts of problems. For instance, this NFD assertion will fail.

This bug was found by NFDFuzz, an experimental fuzzer for NFD and ndn-cxx.

Stack trace of the failed assertion in NFD:

fuzzer: ../daemon/fw/forwarder.cpp:526: void nfd::Forwarder::insertDeadNonceList(pit::Entry &, nfd::face::Face *): Assertion `pitEntry.dataFreshnessPeriod >= 0_ms' failed.
==29831== ERROR: libFuzzer: deadly signal
    #0 0x602cf7 in __sanitizer_print_stack_trace /tmp/final/llvm.src/projects/compiler-rt/lib/asan/asan_stack.cc:38:3
    #1 0x540b46 in fuzzer::Fuzzer::CrashCallback() /tmp/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:233:5
    #2 0x540b0f in fuzzer::Fuzzer::StaticCrashSignalCallback() /tmp/final/llvm.src/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:206:6
    #3 0x7fa90de9538f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1138f)
    #4 0x7fa90d18a427 in gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x35427)
    #5 0x7fa90d18c029 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x37029)
    #6 0x7fa90d182bd6  (/lib/x86_64-linux-gnu/libc.so.6+0x2dbd6)
    #7 0x7fa90d182c81 in __assert_fail (/lib/x86_64-linux-gnu/libc.so.6+0x2dc81)
    #8 0x814b3a in nfd::Forwarder::insertDeadNonceList(nfd::pit::Entry&, nfd::face::Face*) /users/gjt3/NFD/build/../daemon/fw/forwarder.cpp:526:5
    #9 0x81521b in nfd::Forwarder::onIncomingData(nfd::FaceEndpoint const&, ndn::Data const&) /users/gjt3/NFD/build/../daemon/fw/forwarder.cpp:311:11
    #10 0x81b0e3 in nfd::Forwarder::Forwarder()::$_2::operator()(nfd::face::Face&) const::{lambda(ndn::Data const&, unsigned long const&)#1}::operator()(ndn::Data const&, unsigned long const&) const /users/gjt3/NFD/build/../daemon/fw/forwarder.cpp:61:15
    #11 0x6f28f0 in ndn::util::signal::Signal<nfd::face::LinkService, ndn::Data, unsigned long>::operator()(ndn::Data const&, unsigned long const&) /usr/local/include/ndn-cxx/util/signal/signal.hpp:232:7
    #12 0x6f1344 in nfd::face::LinkService::receiveData(ndn::Data const&, unsigned long const&) /users/gjt3/NFD/build/../daemon/face/link-service.cpp:104:3
    #13 0x6c2bc8 in nfd::face::GenericLinkService::decodeData(ndn::Block const&, ndn::lp::Packet const&, unsigned long const&) /users/gjt3/NFD/build/../daemon/face/generic-link-service.cpp:445:9
    #14 0x6bf908 in nfd::face::GenericLinkService::decodeNetPacket(ndn::Block const&, ndn::lp::Packet const&, unsigned long const&) /users/gjt3/NFD/build/../daemon/face/generic-link-service.cpp:328:15
    #15 0x6bedb7 in nfd::face::GenericLinkService::doReceivePacket(ndn::Block const&, unsigned long const&) /users/gjt3/NFD/build/../daemon/face/generic-link-service.cpp:304:13
    #16 0x9fe210 in nfd::face::StreamTransport<boost::asio::local::stream_protocol>::handleReceive(boost::system::error_code const&, unsigned long) /users/gjt3/NFD/build/../daemon/face/stream-transport.hpp:258:11
    #17 0x9fd9da in _ZN5boost4asio6detail23reactive_socket_recv_opINS0_17mutable_buffers_1EZN3nfd4face15StreamTransportINS0_5local15stream_protocolEE12startReceiveEvEUlDpOT_E_E11do_completeEPNS1_15task_io_serviceEPNS1_25task_io_service_operationERKNS_6system10error_codeEm /usr/include/boost/asio/detail/reactive_socket_recv_op.hpp:110:7
    #18 0x67129a in boost::asio::detail::task_io_service::do_run_one(boost::asio::detail::scoped_lock<boost::asio::detail::posix_mutex>&, boost::asio::detail::task_io_service_thread_info&, boost::system::error_code const&) /usr/include/boost/asio/detail/impl/task_io_service.ipp:372:12
    #19 0x670a0d in boost::asio::detail::task_io_service::run(boost::system::error_code&) /usr/include/boost/asio/detail/impl/task_io_service.ipp:149:10
    #20 0x66e13d in boost::asio::io_service::run() /usr/include/boost/asio/impl/io_service.ipp:59:25
    #21 0x66138a in nfd::NfdRunner::run() /users/gjt3/NFD/build/../daemon/fuzzer.cpp:159:15
    #22 0x646118 in LLVMFuzzerTestOneInput::$_1::operator()() const /users/gjt3/NFD/build/../daemon/fuzzer.cpp:425:17
    #23 0x7fa91540dc7f  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xb8c7f)
    #24 0x7fa90de8b6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)