CVE-2017-13687/CHDLC: Improve bounds and length checks.

[tcpdump] / print-sl.c

diff --git a/print-sl.c b/print-sl.c
index 31a9c5ef73182411d31695f1165efb81e550a8e9..a02077b3773dd2aba38cb40cb189bf83ed8db603 100644 (file)
--- a/print-sl.c
+++ b/print-sl.c
@@ -19,15 +19,16 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#define NETDISSECT_REWORKED
+/* \summary: Compressed Serial Line Internet Protocol printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
-#include "interface.h"
-#include "extract.h"                   /* must come after interface.h */
+#include "netdissect.h"
+#include "extract.h"
 
 #include "ip.h"
 #include "tcp.h"
@@ -62,29 +63,33 @@ sl_if_print(netdissect_options *ndo,
        register u_int length = h->len;
        register const struct ip *ip;
 
-       if (caplen < SLIP_HDRLEN) {
+       if (caplen < SLIP_HDRLEN || length < SLIP_HDRLEN) {
                ND_PRINT((ndo, "%s", tstr));
                return (caplen);
        }
 
+       caplen -= SLIP_HDRLEN;
        length -= SLIP_HDRLEN;
 
-       ip = (struct ip *)(p + SLIP_HDRLEN);
+       ip = (const struct ip *)(p + SLIP_HDRLEN);
 
        if (ndo->ndo_eflag)
                sliplink_print(ndo, p, ip, length);
 
+       if (caplen < 1 || length < 1) {
+               ND_PRINT((ndo, "%s", tstr));
+               return (caplen + SLIP_HDRLEN);
+       }
+
        switch (IP_V(ip)) {
        case 4:
-               ip_print(ndo, (u_char *)ip, length);
+               ip_print(ndo, (const u_char *)ip, length);
                break;
-#ifdef INET6
        case 6:
-               ip6_print(ndo, (u_char *)ip, length);
+               ip6_print(ndo, (const u_char *)ip, length);
                break;
-#endif
        default:
-               printf ("ip v%d", IP_V(ip));
+               ND_PRINT((ndo, "ip v%d", IP_V(ip)));
        }
 
        return (SLIP_HDRLEN);
@@ -105,14 +110,14 @@ sl_bsdos_if_print(netdissect_options *ndo,
 
        length -= SLIP_HDRLEN;
 
-       ip = (struct ip *)(p + SLIP_HDRLEN);
+       ip = (const struct ip *)(p + SLIP_HDRLEN);
 
 #ifdef notdef
        if (ndo->ndo_eflag)
                sliplink_print(ndo, p, ip, length);
 #endif
 
-       ip_print(ndo, (u_char *)ip, length);
+       ip_print(ndo, (const u_char *)ip, length);
 
        return (SLIP_HDRLEN);
 }
@@ -126,8 +131,21 @@ sliplink_print(netdissect_options *ndo,
        u_int hlen;
 
        dir = p[SLX_DIR];
-       ND_PRINT((ndo, dir == SLIPDIR_IN ? "I " : "O "));
+       switch (dir) {
+
+       case SLIPDIR_IN:
+               ND_PRINT((ndo, "I "));
+               break;
 
+       case SLIPDIR_OUT:
+               ND_PRINT((ndo, "O "));
+               break;
+
+       default:
+               ND_PRINT((ndo, "Invalid direction %d ", dir));
+               dir = -1;
+               break;
+       }
        if (ndo->ndo_nflag) {
                /* XXX just dump the header */
                register int i;
@@ -149,14 +167,22 @@ sliplink_print(netdissect_options *ndo,
                 * Get it from the link layer since sl_uncompress_tcp()
                 * has restored the IP header copy to IPPROTO_TCP.
                 */
-               lastconn = ((struct ip *)&p[SLX_CHDR])->ip_p;
+               lastconn = ((const struct ip *)&p[SLX_CHDR])->ip_p;
+               ND_PRINT((ndo, "utcp %d: ", lastconn));
+               if (dir == -1) {
+                       /* Direction is bogus, don't use it */
+                       return;
+               }
                hlen = IP_HL(ip);
-               hlen += TH_OFF((struct tcphdr *)&((int *)ip)[hlen]);
+               hlen += TH_OFF((const struct tcphdr *)&((const int *)ip)[hlen]);
                lastlen[dir][lastconn] = length - (hlen << 2);
-               ND_PRINT((ndo, "utcp %d: ", lastconn));
                break;
 
        default:
+               if (dir == -1) {
+                       /* Direction is bogus, don't use it */
+                       return;
+               }
                if (p[SLX_CHDR] & TYPE_COMPRESSED_TCP) {
                        compressed_sl_print(ndo, &p[SLX_CHDR], ip,
                            length, dir);
@@ -244,7 +270,7 @@ compressed_sl_print(netdissect_options *ndo,
         * 'length - hlen' is the amount of data in the packet.
         */
        hlen = IP_HL(ip);
-       hlen += TH_OFF((struct tcphdr *)&((int32_t *)ip)[hlen]);
+       hlen += TH_OFF((const struct tcphdr *)&((const int32_t *)ip)[hlen]);
        lastlen[dir][lastconn] = length - (hlen << 2);
        ND_PRINT((ndo, " %d (%ld)", lastlen[dir][lastconn], (long)(cp - chdr)));
 }