Libzmq: SIGSEGV when receiving garbage to a XPUB socket

[nagisa]

Issue description

When receiving garbage (i.e. messages not prefixed by \x00 or \x01 to a XPUB socket, the ∅MQ code will cause a segmentation fault when attempting to handle the received data.

Environment

• libzmq version (commit hash if unreleased): 6c613902, but also 4.2.5
• OS: Linux

Minimal test code / Steps to reproduce the issue

N/A

What's the actual result? (include assertion message & call stack if applicable)

Backtrace:

#0  zmq::xpub_t::xread_activated (this=0x7fffe8004b20, pipe_=0x7fffe40152a0)
    at libzmq/src/xpub.cpp:170
#1  0x00007ffff7b860ff in zmq::socket_base_t::process_commands (this=this@entry=0x7fffe8004b20, timeout_=-1, 
    throttle_=throttle_@entry=false)
    at libzmq/src/socket_base.cpp:1368
#2  0x00007ffff7b873f6 in zmq::socket_base_t::recv (this=this@entry=0x7fffe8004b20, msg_=msg_@entry=0x7ffff65f4740, 
    flags_=flags_@entry=0) at libzmq/src/socket_base.cpp:1249
#3  0x00007ffff7ba35d9 in s_recvmsg (s_=s_@entry=0x7fffe8004b20, msg_=msg_@entry=0x7ffff65f4740, 
    flags_=flags_@entry=0) at libzmq/src/zmq.cpp:456
#4  0x00007ffff7ba3659 in zmq_recv (s_=<optimized out>, buf_=0x7ffff65f49a0, len_=128, flags_=0)
    at libzmq/src/zmq.cpp:481

Registers:

rax            0x0                 0
rbx            0x7fffe8004b20      140737085721376
rcx            0x7fffe40152a0      140737018679968
rdx            0x0                 0
rsi            0x0                 0
rdi            0x0                 0
rbp            0x7ffff65f4570      0x7ffff65f4570
rsp            0x7ffff65f4510      0x7ffff65f4510
r8             0x0                 0
r9             0x7ffff7047aa0      140737337653920
r10            0x7ffff65f46e0      140737326827232
r11            0x0                 0
r12            0x0                 0
r13            0x7fffe40152a0      140737018679968
r14            0x1                 1
r15            0xffffffffffffffff  -1
rip            0x7ffff7ba0248      0x7ffff7ba0248 <zmq::xpub_t::xread_activated(zmq::pipe_t*)+584>
eflags         0x10246             [ PF ZF IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

Disassembly:

167                 if (subscribe)
168                     *data = 1;
   0x00007ffff7ba02ff <+767>:   movb   $0x1,-0x1(%r12)
   0x00007ffff7ba0305 <+773>:   jmpq   0x7ffff7ba024e <zmq::xpub_t::xread_activated(zmq::pipe_t*)+590>
   0x00007ffff7ba030a <+778>:   nopw   0x0(%rax,%rax,1)
   0x00007ffff7ba0310 <+784>:   lea    0x5d8(%rbx),%rdi

169                 else
170                     *data = 0;
=> 0x00007ffff7ba0248 <+584>:   movb   $0x0,-0x1(%r12)

171 
172                 _pending_data.push_back (blob_t (data, size));

Locals:

notify = true
msg_data = <optimized out>
data = 0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>
metadata = 0x7fffe400cf70
size = 1
subscribe = <optimized out>
sub = {_u = {base = {metadata = 0x7fffe400cf70, 
      unused = "cam 1Y\vSocket-Type\000\000\000\004XSUB\377\377\377\377\377\377\320\005", type = 101 'e', 
      flags = 0 '\000', group = "\000\177", '\000' <repeats 13 times>, routing_id = 0}, vsm = {
      metadata = 0x7fffe400cf70, 
      data = "cam 1Y\vSocket-Type\000\000\000\004XSUB\377\377\377\377\377\377", <incomplete sequence \320>, 
      size = 5 '\005', type = 101 'e', flags = 0 '\000', group = "\000\177", '\000' <repeats 13 times>, 
      routing_id = 0}, lmsg = {metadata = 0x7fffe400cf70, content = 0x530b5931206d6163, 
      unused = "ocket-Type\000\000\000\004XSUB\377\377\377\377\377\377\320\005", type = 101 'e', flags = 0 '\000', 
      group = "\000\177", '\000' <repeats 13 times>, routing_id = 0}, zclmsg = {metadata = 0x7fffe400cf70, 
      content = 0x530b5931206d6163, unused = "ocket-Type\000\000\000\004XSUB\377\377\377\377\377\377\320\005", 
      type = 101 'e', flags = 0 '\000', group = "\000\177", '\000' <repeats 13 times>, routing_id = 0}, cmsg = {
      metadata = 0x7fffe400cf70, data = 0x530b5931206d6163, size = 8742662754573968239, 
      unused = "pe\000\000\000\004XSUB\377\377\377\377\377\377\320\005", type = 101 'e', flags = 0 '\000', 
      group = "\000\177", '\000' <repeats 13 times>, routing_id = 0}, delimiter = {metadata = 0x7fffe400cf70, 
      unused = "cam 1Y\vSocket-Type\000\000\000\004XSUB\377\377\377\377\377\377\320\005", type = 101 'e', 
      flags = 0 '\000', group = "\000\177", '\000' <repeats 13 times>, routing_id = 0}}}

What's the expected result?

∅MQ should not crash in any circumstances.

[sigiesec]

Malformed messages should probably be ignored. A new monitoring event might be emitted to make this observable.

[stale[bot]]

This issue has been automatically marked as stale because it has not had activity for 365 days. It will be closed if no further activity occurs within 56 days. Thank you for your contributions.

[nagisa]

What?