CVE-2017-13045/VQP: add some bounds checks

[tcpdump] / util-print.c

diff --git a/util-print.c b/util-print.c
index d0f014fdf77d7379391541255a1982f881c3d4f1..90e11b9f3b80b02b6a42d62f001c6fcdc6070b0b 100644 (file)
--- a/util-print.c
+++ b/util-print.c
@@ -21,7 +21,7 @@
 
 /*
  * txtproto_print() derived from original code by Hannes Gredler
- * (hannes@juniper.net):
+ * (hannes@gredler.at):
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that: (1) source code
@@ -423,22 +423,29 @@ void
 signed_relts_print(netdissect_options *ndo,
                    int32_t secs)
 {
-       if (secs == -2147483648) {
-               /*
-                * -2^31; you can't fit its absolute value into a 32-bit
-                * signed integer.
-                *
-                * We calculate the right string by hand.
-                */
-               ND_PRINT((ndo, "-68y5w3h14m8s"));
-               return;
-       }
        if (secs < 0) {
-               /*
-                * We now know -secs will fit into secs.
-                */
                ND_PRINT((ndo, "-"));
-               secs = -secs;
+               if (secs == INT32_MIN) {
+                       /*
+                        * -2^31; you can't fit its absolute value into
+                        * a 32-bit signed integer.
+                        *
+                        * Just directly pass said absolute value to
+                        * unsigned_relts_print() directly.
+                        *
+                        * (XXX - does ISO C guarantee that -(-2^n),
+                        * when calculated and cast to an n-bit unsigned
+                        * integer type, will have the value 2^n?)
+                        */
+                       unsigned_relts_print(ndo, 2147483648U);
+               } else {
+                       /*
+                        * We now know -secs will fit into an int32_t;
+                        * negate it and pass that to unsigned_relts_print().
+                        */
+                       unsigned_relts_print(ndo, -secs);
+               }
+               return;
        }
        unsigned_relts_print(ndo, secs);
 }
@@ -514,8 +521,9 @@ static char *
 bittok2str_internal(register const struct tok *lp, register const char *fmt,
           register u_int v, const char *sep)
 {
-        static char buf[256]; /* our stringbuffer */
-        int buflen=0;
+        static char buf[1024+1]; /* our string buffer */
+        char *bufp = buf;
+        size_t space_left = sizeof(buf), string_size;
         register u_int rotbit; /* this is the bit we rotate through all bitpositions */
         register u_int tokval;
         const char * sepstr = "";
@@ -530,8 +538,20 @@ bittok2str_internal(register const struct tok *lp, register const char *fmt,
                  */
                if (tokval == (v&rotbit)) {
                     /* ok we have found something */
-                    buflen+=snprintf(buf+buflen, sizeof(buf)-buflen, "%s%s",
-                                     sepstr, lp->s);
+                    if (space_left <= 1)
+                        return (buf); /* only enough room left for NUL, if that */
+                    string_size = strlcpy(bufp, sepstr, space_left);
+                    if (string_size >= space_left)
+                        return (buf);    /* we ran out of room */
+                    bufp += string_size;
+                    space_left -= string_size;
+                    if (space_left <= 1)
+                        return (buf); /* only enough room left for NUL, if that */
+                    string_size = strlcpy(bufp, lp->s, space_left);
+                    if (string_size >= space_left)
+                        return (buf);    /* we ran out of room */
+                    bufp += string_size;
+                    space_left -= string_size;
                     sepstr = sep;
                     break;
                 }
@@ -540,7 +560,7 @@ bittok2str_internal(register const struct tok *lp, register const char *fmt,
             lp++;
        }
 
-        if (buflen == 0)
+        if (bufp == buf)
             /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
             (void)snprintf(buf, sizeof(buf), fmt == NULL ? "#%08x" : fmt, v);
         return (buf);
@@ -895,7 +915,7 @@ safeputs(netdissect_options *ndo,
 {
        u_int idx = 0;
 
-       while (*s && idx < maxlen) {
+       while (idx < maxlen && *s) {
                safeputchar(ndo, *s);
                idx++;
                s++;