Test hdr.snaplen to see whether it fits in an int.

Assigning it to p->snapshot, and then checking whether the result is
negative, should work in practice, but it gets unsigned-behavior
warnings.  Test beforehand whether it's valid, and only assign it to
p->snapshot if it is.

This should address the pcap.c part of GitHub issue
the-tcpdump-group/tcpdump#785.

diff --git a/sf-pcap.c b/sf-pcap.c
index 23057a0ce4c6891d70367e80c0a2e19cf02eafbe..9fab5997d0f42502a5c5fee36a02ec04308e7c16 100644 (file)
--- a/sf-pcap.c
+++ b/sf-pcap.c
@@ -249,8 +249,7 @@ pcap_check_header(const uint8_t *magic, FILE *fp, u_int precision, char *errbuf,
        p->swapped = swapped;
        p->version_major = hdr.version_major;
        p->version_minor = hdr.version_minor;
-       p->snapshot = hdr.snaplen;
-       if (p->snapshot <= 0) {
+       if (hdr.snaplen == 0 || hdr.snaplen > INT_MAX) {
                /*
                 * Bogus snapshot length; use the maximum for this
                 * link-layer type as a fallback.
@@ -260,7 +259,8 @@ pcap_check_header(const uint8_t *magic, FILE *fp, u_int precision, char *errbuf,
                 * unsigned int.
                 */
                p->snapshot = max_snaplen_for_dlt(hdr.linktype);
-       }
+       } else
+               p->snapshot = hdr.snaplen;
        p->linktype = linktype_to_dlt(LT_LINKTYPE(hdr.linktype));
        p->linktype_ext = LT_LINKTYPE_EXT(hdr.linktype);
 

diff --git a/sf-pcapng.c b/sf-pcapng.c
index 52f795f76db4cf4730598d4d5ba23708d9aa1568..2881da349b7f631666e39a7c7792b61f82e8d3ff 100644 (file)
--- a/sf-pcapng.c
+++ b/sf-pcapng.c
@@ -32,6 +32,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h> /* for INT_MAX */
 
 #include "pcap-int.h"
 
@@ -1047,8 +1048,7 @@ pcap_ng_check_header(const uint8_t *magic, FILE *fp, u_int precision,
        }
 
 done:
-       p->snapshot = idbp->snaplen;
-       if (p->snapshot <= 0) {
+       if (idbp->snaplen == 0 || idbp->snaplen > INT_MAX) {
                /*
                 * Bogus snapshot length; use the maximum for this
                 * link-layer type as a fallback.
@@ -1058,7 +1058,8 @@ done:
                 * unsigned int.
                 */
                p->snapshot = max_snaplen_for_dlt(idbp->linktype);
-       }
+       } else
+               p->snapshot = idbp->snaplen;
        p->linktype = linktype_to_dlt(idbp->linktype);
        p->linktype_ext = 0;