CVE-2016-7931/Add bounds and length checks.

[tcpdump] / util-print.c

diff --git a/util-print.c b/util-print.c
index 5c72a26b7829eeb213be27bb09e5dd9cbc96b626..113f784660c8652d8da5bcddc8a347d617904a8a 100644 (file)
--- a/util-print.c
+++ b/util-print.c
@@ -39,24 +39,57 @@
 #include "config.h"
 #endif
 
 #include "config.h"
 #endif
 

-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>

 
 #include <sys/stat.h>
 
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
 
 #include <sys/stat.h>
 
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif

+#include <ctype.h>

 #include <stdio.h>
 #include <stdarg.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include <stdio.h>
 #include <stdarg.h>
 #include <stdlib.h>
 #include <string.h>
 

-#include "interface.h"
+#include "netdissect.h"
+#include "ascii_strcasecmp.h"
+#include "timeval-operations.h"
+
+int32_t thiszone;              /* seconds offset from gmt to local time */
+/* invalid string to print '(invalid)' for malformed or corrupted packets */
+const char istr[] = " (invalid)";
+
+/*
+ * timestamp display buffer size, the biggest size of both formats is needed
+ * sizeof("0000000000.000000000") > sizeof("00:00:00.000000000")
+ */
+#define TS_BUF_SIZE sizeof("0000000000.000000000")
+
+#define TOKBUFSIZE 128
+
+/*
+ * Print out a character, filtering out the non-printable ones
+ */
+void
+fn_print_char(netdissect_options *ndo, u_char c)
+{
+       if (!ND_ISASCII(c)) {
+               c = ND_TOASCII(c);
+               ND_PRINT((ndo, "M-"));
+       }
+       if (!ND_ISPRINT(c)) {
+               c ^= 0x40;      /* DEL to ?, others to alpha */
+               ND_PRINT((ndo, "^"));
+       }
+       ND_PRINT((ndo, "%c", c));
+}

 
 /*
  * Print out a null-terminated filename (or other ascii string).
  * If ep is NULL, assume no truncation check is needed.
  * Return true if truncated.
 
 /*
  * Print out a null-terminated filename (or other ascii string).
  * If ep is NULL, assume no truncation check is needed.
  * Return true if truncated.

+ * Stop at ep (if given) or before the null char, whichever is first.

  */
 int
 fn_print(netdissect_options *ndo,
  */
 int
 fn_print(netdissect_options *ndo,


@@ -89,6 +122,7 @@ fn_print(netdissect_options *ndo,
  * Print out a counted filename (or other ascii string).
  * If ep is NULL, assume no truncation check is needed.
  * Return true if truncated.
  * Print out a counted filename (or other ascii string).
  * If ep is NULL, assume no truncation check is needed.
  * Return true if truncated.

+ * Stop at ep (if given) or after n bytes, whichever is first.

  */
 int
 fn_printn(netdissect_options *ndo,
  */
 int
 fn_printn(netdissect_options *ndo,


@@ -116,6 +150,8 @@ fn_printn(netdissect_options *ndo,
  * Print out a null-padded filename (or other ascii string).
  * If ep is NULL, assume no truncation check is needed.
  * Return true if truncated.
  * Print out a null-padded filename (or other ascii string).
  * If ep is NULL, assume no truncation check is needed.
  * Return true if truncated.

+ * Stop at ep (if given) or after n bytes or before the null char,
+ * whichever is first.

  */
 int
 fn_printzp(netdissect_options *ndo,
  */
 int
 fn_printzp(netdissect_options *ndo,


@@ -154,9 +190,8 @@ ts_format(netdissect_options *ndo
 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
 _U_
 #endif
 #ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
 _U_
 #endif

-, int sec, int usec)
+, int sec, int usec, char *buf)

 {
 {

-       static char buf[sizeof("00:00:00.000000000")];

        const char *format;
 
 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
        const char *format;
 
 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION


@@ -171,19 +206,56 @@ _U_
                break;
 
        default:
                break;
 
        default:

-               format = "%02d:%02d:%02d.{unknown precision}";
+               format = "%02d:%02d:%02d.{unknown}";

                break;
        }
 #else
        format = "%02d:%02d:%02d.%06u";
 #endif
 
                break;
        }
 #else
        format = "%02d:%02d:%02d.%06u";
 #endif
 

-       snprintf(buf, sizeof(buf), format,
+       snprintf(buf, TS_BUF_SIZE, format,

                  sec / 3600, (sec % 3600) / 60, sec % 60, usec);
 
         return buf;
 }
 
                  sec / 3600, (sec % 3600) / 60, sec % 60, usec);
 
         return buf;
 }
 

+/*
+ * Format the timestamp - Unix timeval style
+ */
+static char *
+ts_unix_format(netdissect_options *ndo
+#ifndef HAVE_PCAP_SET_TSTAMP_PRECISION
+_U_
+#endif
+, int sec, int usec, char *buf)
+{
+       const char *format;
+
+#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
+       switch (ndo->ndo_tstamp_precision) {
+
+       case PCAP_TSTAMP_PRECISION_MICRO:
+               format = "%u.%06u";
+               break;
+
+       case PCAP_TSTAMP_PRECISION_NANO:
+               format = "%u.%09u";
+               break;
+
+       default:
+               format = "%u.{unknown}";
+               break;
+       }
+#else
+       format = "%u.%06u";
+#endif
+
+       snprintf(buf, TS_BUF_SIZE, format,
+                (unsigned)sec, (unsigned)usec);
+
+       return buf;
+}
+

 /*
  * Print the timestamp
  */
 /*
  * Print the timestamp
  */


@@ -194,52 +266,63 @@ ts_print(netdissect_options *ndo,
        register int s;
        struct tm *tm;
        time_t Time;
        register int s;
        struct tm *tm;
        time_t Time;

-       static unsigned b_sec;
-       static unsigned b_usec;
-       int d_usec;
-       int d_sec;
+       char buf[TS_BUF_SIZE];
+       static struct timeval tv_ref;
+       struct timeval tv_result;
+       int negative_offset;
+       int nano_prec;

 
        switch (ndo->ndo_tflag) {
 
        case 0: /* Default */
                s = (tvp->tv_sec + thiszone) % 86400;
 
        switch (ndo->ndo_tflag) {
 
        case 0: /* Default */
                s = (tvp->tv_sec + thiszone) % 86400;

-               ND_PRINT((ndo, "%s ", ts_format(ndo, s, tvp->tv_usec)));
+               ND_PRINT((ndo, "%s ", ts_format(ndo, s, tvp->tv_usec, buf)));

                break;
 
        case 1: /* No time stamp */
                break;
 
        case 2: /* Unix timeval style */
                break;
 
        case 1: /* No time stamp */
                break;
 
        case 2: /* Unix timeval style */

-               ND_PRINT((ndo, "%u.%06u ",
-                            (unsigned)tvp->tv_sec,
-                            (unsigned)tvp->tv_usec));
+               ND_PRINT((ndo, "%s ", ts_unix_format(ndo,
+                         tvp->tv_sec, tvp->tv_usec, buf)));

                break;
 
                break;
 

-       case 3: /* Microseconds since previous packet */
-        case 5: /* Microseconds since first packet */
-               if (b_sec == 0) {
-                        /* init timestamp for first packet */
-                        b_usec = tvp->tv_usec;
-                        b_sec = tvp->tv_sec;
-                }
+       case 3: /* Microseconds/nanoseconds since previous packet */
+        case 5: /* Microseconds/nanoseconds since first packet */
+#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
+               switch (ndo->ndo_tstamp_precision) {
+               case PCAP_TSTAMP_PRECISION_MICRO:
+                       nano_prec = 0;
+                       break;
+               case PCAP_TSTAMP_PRECISION_NANO:
+                       nano_prec = 1;
+                       break;
+               default:
+                       nano_prec = 0;
+                       break;
+               }
+#else
+               nano_prec = 0;
+#endif
+               if (!(netdissect_timevalisset(&tv_ref)))
+                       tv_ref = *tvp; /* set timestamp for first packet */

 
 

-                d_usec = tvp->tv_usec - b_usec;
-                d_sec = tvp->tv_sec - b_sec;
+               negative_offset = netdissect_timevalcmp(tvp, &tv_ref, <);
+               if (negative_offset)
+                       netdissect_timevalsub(&tv_ref, tvp, &tv_result, nano_prec);
+               else
+                       netdissect_timevalsub(tvp, &tv_ref, &tv_result, nano_prec);

 
 

-                while (d_usec < 0) {
-                    d_usec += 1000000;
-                    d_sec--;
-                }
+               ND_PRINT((ndo, (negative_offset ? "-" : " ")));

 
 

-                ND_PRINT((ndo, "%s ", ts_format(ndo, d_sec, d_usec)));
+               ND_PRINT((ndo, "%s ", ts_format(ndo,
+                         tv_result.tv_sec, tv_result.tv_usec, buf)));

 
 

-                if (ndo->ndo_tflag == 3) { /* set timestamp for last packet */
-                    b_sec = tvp->tv_sec;
-                    b_usec = tvp->tv_usec;
-                }
+                if (ndo->ndo_tflag == 3)
+                       tv_ref = *tvp; /* set timestamp for previous packet */

                break;
 
                break;
 

-       case 4: /* Default + Date*/
+       case 4: /* Default + Date */

                s = (tvp->tv_sec + thiszone) % 86400;
                Time = (tvp->tv_sec + thiszone) - s;
                tm = gmtime (&Time);
                s = (tvp->tv_sec + thiszone) % 86400;
                Time = (tvp->tv_sec + thiszone) - s;
                tm = gmtime (&Time);


@@ -248,7 +331,7 @@ ts_print(netdissect_options *ndo,
                else
                        ND_PRINT((ndo, "%04d-%02d-%02d %s ",
                                tm->tm_year+1900, tm->tm_mon+1, tm->tm_mday,
                else
                        ND_PRINT((ndo, "%04d-%02d-%02d %s ",
                                tm->tm_year+1900, tm->tm_mon+1, tm->tm_mday,

-                               ts_format(ndo, s, tvp->tv_usec)));
+                               ts_format(ndo, s, tvp->tv_usec, buf)));

                break;
        }
 }
                break;
        }
 }


@@ -336,9 +419,9 @@ tok2strbuf(register const struct tok *lp, register const char *fmt,
  */
 const char *
 tok2str(register const struct tok *lp, register const char *fmt,
  */
 const char *
 tok2str(register const struct tok *lp, register const char *fmt,

-       register int v)
+       register u_int v)

 {
 {

-       static char buf[4][128];
+       static char buf[4][TOKBUFSIZE];

        static int idx = 0;
        char *ret;
 
        static int idx = 0;
        char *ret;
 


@@ -354,12 +437,12 @@ tok2str(register const struct tok *lp, register const char *fmt,
  */
 static char *
 bittok2str_internal(register const struct tok *lp, register const char *fmt,
  */
 static char *
 bittok2str_internal(register const struct tok *lp, register const char *fmt,

-          register int v, register int sep)
+          register u_int v, const char *sep)

 {
         static char buf[256]; /* our stringbuffer */
         int buflen=0;
 {
         static char buf[256]; /* our stringbuffer */
         int buflen=0;

-        register int rotbit; /* this is the bit we rotate through all bitpositions */
-        register int tokval;
+        register u_int rotbit; /* this is the bit we rotate through all bitpositions */
+        register u_int tokval;

         const char * sepstr = "";
 
        while (lp != NULL && lp->s != NULL) {
         const char * sepstr = "";
 
        while (lp != NULL && lp->s != NULL) {


@@ -374,7 +457,7 @@ bittok2str_internal(register const struct tok *lp, register const char *fmt,
                     /* ok we have found something */
                     buflen+=snprintf(buf+buflen, sizeof(buf)-buflen, "%s%s",
                                      sepstr, lp->s);
                     /* ok we have found something */
                     buflen+=snprintf(buf+buflen, sizeof(buf)-buflen, "%s%s",
                                      sepstr, lp->s);

-                    sepstr = sep ? ", " : "";
+                    sepstr = sep;

                     break;
                 }
                 rotbit=rotbit<<1; /* no match - lets shift and try again */
                     break;
                 }
                 rotbit=rotbit<<1; /* no match - lets shift and try again */


@@ -384,7 +467,7 @@ bittok2str_internal(register const struct tok *lp, register const char *fmt,
 
         if (buflen == 0)
             /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */
 
         if (buflen == 0)
             /* bummer - lets print the "unknown" message as advised in the fmt string if we got one */

-            (void)snprintf(buf, sizeof(buf), fmt == NULL ? "#%d" : fmt, v);
+            (void)snprintf(buf, sizeof(buf), fmt == NULL ? "#%08x" : fmt, v);

         return (buf);
 }
 
         return (buf);
 }
 


@@ -394,9 +477,9 @@ bittok2str_internal(register const struct tok *lp, register const char *fmt,
  */
 char *
 bittok2str_nosep(register const struct tok *lp, register const char *fmt,
  */
 char *
 bittok2str_nosep(register const struct tok *lp, register const char *fmt,

-          register int v)
+          register u_int v)

 {
 {

-    return (bittok2str_internal(lp, fmt, v, 0));
+    return (bittok2str_internal(lp, fmt, v, ""));

 }
 
 /*
 }
 
 /*


@@ -405,14 +488,14 @@ bittok2str_nosep(register const struct tok *lp, register const char *fmt,
  */
 char *
 bittok2str(register const struct tok *lp, register const char *fmt,
  */
 char *
 bittok2str(register const struct tok *lp, register const char *fmt,

-          register int v)
+          register u_int v)

 {
 {

-    return (bittok2str_internal(lp, fmt, v, 1));
+    return (bittok2str_internal(lp, fmt, v, ", "));

 }
 
 /*
  * Convert a value to a string using an array; the macro
 }
 
 /*
  * Convert a value to a string using an array; the macro

- * tok2strary() in <interface.h> is the public interface to
+ * tok2strary() in <netdissect.h> is the public interface to

  * this function and ensures that the second argument is
  * correct for bounds-checking.
  */
  * this function and ensures that the second argument is
  * correct for bounds-checking.
  */


@@ -420,7 +503,7 @@ const char *
 tok2strary_internal(register const char **lp, int n, register const char *fmt,
        register int v)
 {
 tok2strary_internal(register const char **lp, int n, register const char *fmt,
        register int v)
 {

-       static char buf[128];
+       static char buf[TOKBUFSIZE];

 
        if (v >= 0 && v < n && lp[v] != NULL)
                return lp[v];
 
        if (v >= 0 && v < n && lp[v] != NULL)
                return lp[v];


@@ -461,7 +544,6 @@ mask2plen(uint32_t mask)
        return (prefix_len);
 }
 
        return (prefix_len);
 }
 

-#ifdef INET6

 int
 mask62plen(const u_char *mask)
 {
 int
 mask62plen(const u_char *mask)
 {


@@ -488,7 +570,6 @@ mask62plen(const u_char *mask)
        }
        return (cidr_len);
 }
        }
        return (cidr_len);
 }

-#endif /* INET6 */

 
 /*
  * Routine to print out information for text-based protocols such as FTP,
 
 /*
  * Routine to print out information for text-based protocols such as FTP,


@@ -662,7 +743,7 @@ txtproto_print(netdissect_options *ndo, const u_char *pptr, u_int len,
                if (idx != 0) {
                        /* Is this a valid request name? */
                        while ((cmd = *cmds++) != NULL) {
                if (idx != 0) {
                        /* Is this a valid request name? */
                        while ((cmd = *cmds++) != NULL) {

-                               if (strcasecmp((const char *)token, cmd) == 0) {
+                               if (ascii_strcasecmp((const char *)token, cmd) == 0) {

                                        /* Yes. */
                                        is_reqresp = 1;
                                        break;
                                        /* Yes. */
                                        is_reqresp = 1;
                                        break;


@@ -702,7 +783,7 @@ txtproto_print(netdissect_options *ndo, const u_char *pptr, u_int len,
 
        /* Capitalize the protocol name */
        for (pnp = protoname; *pnp != '\0'; pnp++)
 
        /* Capitalize the protocol name */
        for (pnp = protoname; *pnp != '\0'; pnp++)

-               ND_PRINT((ndo, "%c", toupper(*pnp)));
+               ND_PRINT((ndo, "%c", toupper((u_char)*pnp)));

 
        if (is_reqresp) {
                /*
 
        if (is_reqresp) {
                /*