Fix two null pointer crashes of breakloop and can_set_rfmon

pcap_open_dead and pcap_fopen_offline has not initialized the breakloop_op and can_set_rfmon_op callback respectively,
if pcap_breakloop() is called followed by pcap_open_dead() and pcap_can_set_rfmon() is called followed by pcap_fopen_offline()
then the null function pointer crashes will happen.

This commit adds two default implementation pcap_breakloop_dead and sf_cant_set_rfmon and uses them to initialize those two missed callbacks.

Signed-off-by: hopper-vul <[email protected]>
(cherry picked from commit eae1a8597f0c88508b3f756c69daefc3dd814e99)

diff --git a/pcap.c b/pcap.c
index 7b02e7b2db333fbe0aaa6d33acd581bce8362ee9..3d4c76d65e6a0e916c969a52a92630cbcef94eee 100644 (file)
--- a/pcap.c
+++ b/pcap.c
@@ -4201,6 +4201,14 @@ pcap_read_dead(pcap_t *p, int cnt _U_, pcap_handler callback _U_,
        return (-1);
 }
 
+static int
+pcap_breakloop_dead(pcap_t *p)
+{
+       snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+           "A breakloop cannot be set on a pcap_open_dead pcap_t");
+       return (-1);
+}
+
 static int
 pcap_inject_dead(pcap_t *p, const void *buf _U_, int size _U_)
 {
@@ -4414,6 +4422,7 @@ pcap_open_dead_with_tstamp_precision(int linktype, int snaplen, u_int precision)
        p->live_dump_ended_op = pcap_live_dump_ended_dead;
        p->get_airpcap_handle_op = pcap_get_airpcap_handle_dead;
 #endif
+       p->breakloop_op = pcap_breakloop_dead;
        p->cleanup_op = pcap_cleanup_dead;
 
        /*

diff --git a/savefile.c b/savefile.c
index 2b42b9b4558208dfb5d5cb62f9ca0b679c0783f2..fc2dd54961669af7f93e2db5dd00c89ba786b756 100644 (file)
--- a/savefile.c
+++ b/savefile.c
@@ -111,6 +111,16 @@ sf_setnonblock(pcap_t *p, int nonblock _U_)
        return (-1);
 }
 
+static int
+sf_cant_set_rfmon(pcap_t *p _U_)
+{
+       /*
+        * This is a savefile, not a live capture file, so never say
+        * it's monitor mode.
+        */
+       return (0);
+}
+
 static int
 sf_stats(pcap_t *p, struct pcap_stat *ps _U_)
 {
@@ -551,6 +561,7 @@ found:
        p->selectable_fd = fileno(fp);
 #endif
 
+       p->can_set_rfmon_op = sf_cant_set_rfmon;
        p->read_op = pcap_offline_read;
        p->inject_op = sf_inject;
        p->setfilter_op = install_bpf_program;