Submit #623640: tcpreplay tcpprep tcpreplay version 6fcbf03 (the newest master in https://github.com/appneta/tcpreplay) Segmentation Fault

# TCPPREP Segmentation Fault Vulnerability in __strstr_sse2 Function

## Vulnerability Summary

During fuzzing, a critical segmentation fault vulnerability has been discovered in the tcpprep utility from the tcpreplay suite. The vulnerability occurs in the `__strstr_sse2` function within `strstr.c` at line 84, triggered through the option loading and processing path. This leads to an invalid memory access operation that causes an immediate program crash.

## Technical Details

- **Vulnerability Type**: Segmentation Fault
- **Affected Function**: `__strstr_sse2`
- **Source File**: `strstr.c`
- **Line Number**: 84
- **Signal**: SIGABRT (6)

## Vulnerability Mechanism and Root Cause

This segmentation fault vulnerability is caused by an invalid memory access in the string search functionality used during option processing. The root issue lies in the `__strstr_sse2` function where the program attempts to access memory at an invalid address during string operations.

The vulnerability occurs when:
1. The program attempts to process configuration options through `optionProcess`
2. During option processing, `optionSaveFile` is called which triggers `remove_settings`
3. `remove_settings` calls `strstr` function which delegates to the optimized `__strstr_sse2` implementation
4. `__strstr_sse2` at line 84 attempts to read from an invalid memory address 0xffffffffffffffe0, causing a segmentation fault

The invalid address 0xffffffffffffffe0 suggests an underflow condition where a pointer has been decremented beyond valid memory boundaries, likely due to improper string pointer arithmetic or uninitialized/corrupted pointer values.

## AddressSanitizer Report

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2174081==ERROR: AddressSanitizer: SEGV on unknown address 0xffffffffffffffe0 (pc 0x7faf52b203b7 bp 0x00000000003c sp 0x7ffd6d95dd48 T0)
==2174081==The signal is caused by a READ memory access.
#0 0x7faf52b203b7 string/../sysdeps/x86_64/multiarch/strchr-avx2.S:279
#1 0x7faf52a2bfff in __strstr_sse2 string/../string/strstr.c:84:31
#2 0x565016d73b89 in strstr (/workspace/benchmark/tmp/need-ana/fz-tcpprep/tcpprep+0x85b89)
#3 0x565016e7c284 in remove_settings /workspace/benchmark/program/tcpreplay-6fcbf03-Jul13-2024/libopts/./save.c:499:30
#4 0x565016e7c284 in open_sv_file /workspace/benchmark/program/tcpreplay-6fcbf03-Jul13-2024/libopts/./save.c:564:13
#5 0x565016e7c284 in optionSaveFile /workspace/benchmark/program/tcpreplay-6fcbf03-Jul13-2024/libopts/./save.c:828:10
#6 0x565016e6f08c in optionProcess /workspace/benchmark/program/tcpreplay-6fcbf03-Jul13-2024/libopts/./autoopts.c:367:13
#7 0x565016e3676d in main /workspace/benchmark/program/tcpreplay-6fcbf03-Jul13-2024/src/tcpprep.c:81:5

SUMMARY: AddressSanitizer: SEGV string/../sysdeps/x86_64/multiarch/strchr-avx2.S:279
```

## Call Chain Analysis

The vulnerability is triggered through the following execution path:
1. **main** → **optionProcess** (option processing initialization)
2. **optionProcess** → **optionSaveFile** (attempting to save/process options)
3. **optionSaveFile** → **open_sv_file** → **remove_settings** (settings file processing)
4. **remove_settings** → **strstr** → **__strstr_sse2** (string search operation with invalid pointer)

This indicates the issue occurs during the early stages of option processing, likely when tcpprep attempts to handle configuration files or save operations.

## Proof of Concept

The vulnerability can be triggered by processing the malformed configuration file provided as `POC_tcpprep_segmentation_fault_strstr_sse2`. This file contains specific configuration that causes the segmentation fault condition.

**POC Download**: [Google Drive Link - POC_tcpprep_segmentation_fault_strstr_sse2](https://drive.google.com/file/d/1MWxr3Mv2hmcy1wpBTaRtXykyxszGmcAy/view?usp=sharing)

## Reproduction Steps

1. Compile tcpprep with AddressSanitizer enabled
2. Execute: `tcpprep --load-opts POC_tcpprep_segmentation_fault_strstr_sse2`
3. The program will crash with a segmentation fault error

## Affected Versions

tcpreplay version 6fcbf03 (the newest master in https://github.com/appneta/tcpreplay)

**Credit**
- Xudong Cao (UCAS)
- Yuqing Zhang (UCAS, Zhongguancun Laboratory)

• Source: ⚠️ https://github.com/appneta/tcpreplay/issues/963
• User: nipc-cxd (UID 88335)
• Submission: 07/27/2025 09:13 (1 Year ago)
• Moderation: 08/14/2025 07:53 (18 days later)
• Status: Duplicate
• VulDB entry: 319242 [GNU libopts up to 27.6 __strstr_sse2 memory corruption]
• Points: 0