Skip to content

Fix use-of-uninitialized-value in PcapNgFileReaderDevice::getNextPacketInternal#2132

Open
Shubham7-1 wants to merge 4 commits intoseladb:masterfrom
Shubham7-1:master
Open

Fix use-of-uninitialized-value in PcapNgFileReaderDevice::getNextPacketInternal#2132
Shubham7-1 wants to merge 4 commits intoseladb:masterfrom
Shubham7-1:master

Conversation

@Shubham7-1
Copy link
Copy Markdown

Summary

Fixes the MSAN-reported Use-of-uninitialized-value in pcpp::PcapNgFileReaderDevice::getNextPacketInternal (OSS-Fuzz issue, crash type reported in FuzzWriterNg).

issue: https://issues.oss-fuzz.com/issues/479882050

Root Cause

In light_get_next_packet (light_pcapng_ext.c), the LIGHT_SIMPLE_PACKET_BLOCK branch sets packet_header->data_link only when interface_block_count > 0:

if (pcapng->file_info->interface_block_count > 0)
    packet_header->data_link = pcapng->file_info->link_types[0];
// else: data_link left UNINITIALIZED

When a pcapng file contains a Simple Packet Block without any preceding Interface Description Block, data_link is never written. Back in getNextPacketInternal, the uninitialized pktHeader.data_link value is then read by m_BpfWrapper.matches() and RawPacket::setRawData(), triggering MSAN.

Changes

3rdParty/LightPcapNg/LightPcapNg/src/light_pcapng_ext.c

Added an else clause in the SPB path of light_get_next_packet to always assign data_link. Uses the same 0xFFFF sentinel already used in the EPB "out-of-range interface_id" case, meaning unknown/invalid link type.

Pcap++/src/PcapFileDevice.cpp

Zero-initialized light_packet_header pktHeader{} in getNextPacketInternal as defense-in-depth, ensuring no field is ever read uninitialized regardless of which code path light_get_next_packet takes.

Copilot AI and others added 4 commits May 8, 2026 12:36
…etInternal

- Zero-initialize light_packet_header pktHeader in getNextPacketInternal to
  prevent MSAN use-of-uninitialized-value on any path where light_get_next_packet
  does not fill every field.
- Fix light_get_next_packet's LIGHT_SIMPLE_PACKET_BLOCK branch: add an else
  clause so packet_header->data_link is always set (to 0xFFFF) when there are
  no interface blocks, eliminating the root cause of the uninitialized read.

Agent-Logs-Url: https://github.com/Shivam7-1/PcapPlusPlus/sessions/40af4014-b148-45f0-8e4f-9f159064c5d1

Co-authored-by: Shivam7-1 <55046031+Shivam7-1@users.noreply.github.com>
…-value

Fix use-of-uninitialized-value in PcapNgFileReaderDevice::getNextPacketInternal
Fix use-of-uninitialized-value in PcapNgFileReaderDevice::getNextPacketInternal
@Shubham7-1 Shubham7-1 requested a review from seladb as a code owner May 8, 2026 12:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants