CVE-2016-7931/Add bounds and length checks.

[tcpdump] / print-ip.c

diff --git a/print-ip.c b/print-ip.c
index 32304aedf80b76e2624ad23d13032f4d76cbf48f..cbcdab853ac5e3d3e701eb55a10d65835b363fc4 100644 (file)
--- a/print-ip.c
+++ b/print-ip.c
@@ -19,6 +19,8 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
+/* \summary: IP printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -122,7 +124,7 @@ ip_finddst(netdissect_options *ndo,
                }
        }
 trunc:
-       UNALIGNED_MEMCPY(&retval, &ip->ip_dst.s_addr, sizeof(uint32_t));
+       UNALIGNED_MEMCPY(&retval, &ip->ip_dst, sizeof(uint32_t));
        return retval;
 }
 
@@ -147,9 +149,9 @@ nextproto4_cksum(netdissect_options *ndo,
        ph.len = htons((uint16_t)len);
        ph.mbz = 0;
        ph.proto = next_proto;
-       UNALIGNED_MEMCPY(&ph.src, &ip->ip_src.s_addr, sizeof(uint32_t));
+       UNALIGNED_MEMCPY(&ph.src, &ip->ip_src, sizeof(uint32_t));
        if (IP_HL(ip) == 5)
-               UNALIGNED_MEMCPY(&ph.dst, &ip->ip_dst.s_addr, sizeof(uint32_t));
+               UNALIGNED_MEMCPY(&ph.dst, &ip->ip_dst, sizeof(uint32_t));
        else
                ph.dst = ip_finddst(ndo, ip);
 
@@ -328,6 +330,10 @@ again:
        switch (ipds->nh) {
 
        case IPPROTO_AH:
+               if (!ND_TTEST(*ipds->cp)) {
+                       ND_PRINT((ndo, "[|AH]"));
+                       break;
+               }
                ipds->nh = *ipds->cp;
                ipds->advance = ah_print(ndo, ipds->cp);
                if (ipds->advance <= 0)
@@ -578,17 +584,22 @@ ip_print(netdissect_options *ndo,
         if (ndo->ndo_vflag) {
             ND_PRINT((ndo, "(tos 0x%x", (int)ipds->ip->ip_tos));
             /* ECN bits */
-            if (ipds->ip->ip_tos & 0x03) {
-                switch (ipds->ip->ip_tos & 0x03) {
-                case 1:
-                    ND_PRINT((ndo, ",ECT(1)"));
-                    break;
-                case 2:
-                    ND_PRINT((ndo, ",ECT(0)"));
-                    break;
-                case 3:
-                    ND_PRINT((ndo, ",CE"));
-                }
+            switch (ipds->ip->ip_tos & 0x03) {
+
+            case 0:
+                break;
+
+            case 1:
+                ND_PRINT((ndo, ",ECT(1)"));
+                break;
+
+            case 2:
+                ND_PRINT((ndo, ",ECT(0)"));
+                break;
+
+            case 3:
+                ND_PRINT((ndo, ",CE"));
+                break;
             }
 
             if (ipds->ip->ip_ttl >= 1)
@@ -645,22 +656,24 @@ ip_print(netdissect_options *ndo,
                }
                ip_print_demux(ndo, ipds);
        } else {
-           /* Ultra quiet now means that all this stuff should be suppressed */
-           if (ndo->ndo_qflag > 1) return;
+               /*
+                * Ultra quiet now means that all this stuff should be
+                * suppressed.
+                */
+               if (ndo->ndo_qflag > 1)
+                       return;
 
-           /*
-            * if this isn't the first frag, we're missing the
-            * next level protocol header.  print the ip addr
-            * and the protocol.
-            */
-               if (ipds->off & 0x1fff) {
-                       ND_PRINT((ndo, "%s > %s:", ipaddr_string(ndo, &ipds->ip->ip_src),
-                                 ipaddr_string(ndo, &ipds->ip->ip_dst)));
-                       if (!ndo->ndo_nflag && (proto = getprotobynumber(ipds->ip->ip_p)) != NULL)
-                               ND_PRINT((ndo, " %s", proto->p_name));
-                       else
-                               ND_PRINT((ndo, " ip-proto-%d", ipds->ip->ip_p));
-               }
+               /*
+                * This isn't the first frag, so we're missing the
+                * next level protocol header.  print the ip addr
+                * and the protocol.
+                */
+               ND_PRINT((ndo, "%s > %s:", ipaddr_string(ndo, &ipds->ip->ip_src),
+                         ipaddr_string(ndo, &ipds->ip->ip_dst)));
+               if (!ndo->ndo_nflag && (proto = getprotobynumber(ipds->ip->ip_p)) != NULL)
+                       ND_PRINT((ndo, " %s", proto->p_name));
+               else
+                       ND_PRINT((ndo, " ip-proto-%d", ipds->ip->ip_p));
        }
        return;
 
@@ -672,24 +685,28 @@ trunc:
 void
 ipN_print(netdissect_options *ndo, register const u_char *bp, register u_int length)
 {
-       struct ip hdr;
-
-       if (length < 4) {
+       if (length < 1) {
                ND_PRINT((ndo, "truncated-ip %d", length));
                return;
        }
-       memcpy (&hdr, bp, 4);
-       switch (IP_V(&hdr)) {
-       case 4:
+
+       ND_TCHECK(*bp);
+       switch (*bp & 0xF0) {
+       case 0x40:
                ip_print (ndo, bp, length);
-               return;
-       case 6:
+               break;
+       case 0x60:
                ip6_print (ndo, bp, length);
-               return;
+               break;
        default:
-               ND_PRINT((ndo, "unknown ip %d", IP_V(&hdr)));
-               return;
+               ND_PRINT((ndo, "unknown ip %d", (*bp & 0xF0) >> 4));
+               break;
        }
+       return;
+
+trunc:
+       ND_PRINT((ndo, "%s", tstr));
+       return;
 }
 
 /*