(for 4.9.3) CVE-2018-14880/OSPFv3: Fix a bounds check

[tcpdump] / print-vqp.c

diff --git a/print-vqp.c b/print-vqp.c
index 7614011314c06ef44d4bf106edbf19e099344a1f..90cf8ddfef9bf785395447184afafb7054dc9834 100644 (file)
--- a/print-vqp.c
+++ b/print-vqp.c
@@ -12,11 +12,11 @@
  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  * FOR A PARTICULAR PURPOSE.
  *
  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  * FOR A PARTICULAR PURPOSE.
  *

- * support for the Cisco prop. VQP Protocol
- *

  * Original code by Carles Kishimoto <[email protected]>
  */
 
  * Original code by Carles Kishimoto <[email protected]>
  */
 

+/* \summary: Cisco VLAN Query Protocol (VQP) printer */
+

 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif


@@ -26,6 +26,7 @@
 #include "netdissect.h"
 #include "extract.h"
 #include "addrtoname.h"
 #include "netdissect.h"
 #include "extract.h"
 #include "addrtoname.h"

+#include "ether.h"

 
 #define VQP_VERSION                            1
 #define VQP_EXTRACT_VERSION(x) ((x)&0xFF)
 
 #define VQP_VERSION                            1
 #define VQP_EXTRACT_VERSION(x) ((x)&0xFF)


@@ -105,13 +106,15 @@ vqp_print(netdissect_options *ndo, register const u_char *pptr, register u_int l
     const u_char *tptr;
     uint16_t vqp_obj_len;
     uint32_t vqp_obj_type;
     const u_char *tptr;
     uint16_t vqp_obj_len;
     uint32_t vqp_obj_type;

-    int tlen;
+    u_int tlen;

     uint8_t nitems;
 
     tptr=pptr;
     tlen = len;
     vqp_common_header = (const struct vqp_common_header_t *)pptr;
     ND_TCHECK(*vqp_common_header);
     uint8_t nitems;
 
     tptr=pptr;
     tlen = len;
     vqp_common_header = (const struct vqp_common_header_t *)pptr;
     ND_TCHECK(*vqp_common_header);

+    if (sizeof(struct vqp_common_header_t) > tlen)
+        goto trunc;

 
     /*
      * Sanity checking of the header.
 
     /*
      * Sanity checking of the header.


@@ -151,6 +154,9 @@ vqp_print(netdissect_options *ndo, register const u_char *pptr, register u_int l
     while (nitems > 0 && tlen > 0) {
 
         vqp_obj_tlv = (const struct vqp_obj_tlv_t *)tptr;
     while (nitems > 0 && tlen > 0) {
 
         vqp_obj_tlv = (const struct vqp_obj_tlv_t *)tptr;

+        ND_TCHECK(*vqp_obj_tlv);
+        if (sizeof(struct vqp_obj_tlv_t) > tlen)
+            goto trunc;

         vqp_obj_type = EXTRACT_32BITS(vqp_obj_tlv->obj_type);
         vqp_obj_len = EXTRACT_16BITS(vqp_obj_tlv->obj_length);
         tptr+=sizeof(struct vqp_obj_tlv_t);
         vqp_obj_type = EXTRACT_32BITS(vqp_obj_tlv->obj_type);
         vqp_obj_len = EXTRACT_16BITS(vqp_obj_tlv->obj_length);
         tptr+=sizeof(struct vqp_obj_tlv_t);


@@ -167,9 +173,13 @@ vqp_print(netdissect_options *ndo, register const u_char *pptr, register u_int l
 
         /* did we capture enough for fully decoding the object ? */
         ND_TCHECK2(*tptr, vqp_obj_len);
 
         /* did we capture enough for fully decoding the object ? */
         ND_TCHECK2(*tptr, vqp_obj_len);

+        if (vqp_obj_len > tlen)
+            goto trunc;

 
         switch(vqp_obj_type) {
        case VQP_OBJ_IP_ADDRESS:
 
         switch(vqp_obj_type) {
        case VQP_OBJ_IP_ADDRESS:

+            if (vqp_obj_len != 4)
+                goto trunc;

             ND_PRINT((ndo, "%s (0x%08x)", ipaddr_string(ndo, tptr), EXTRACT_32BITS(tptr)));
             break;
             /* those objects have similar semantics - fall through */
             ND_PRINT((ndo, "%s (0x%08x)", ipaddr_string(ndo, tptr), EXTRACT_32BITS(tptr)));
             break;
             /* those objects have similar semantics - fall through */


@@ -182,6 +192,8 @@ vqp_print(netdissect_options *ndo, register const u_char *pptr, register u_int l
             /* those objects have similar semantics - fall through */
        case VQP_OBJ_MAC_ADDRESS:
        case VQP_OBJ_MAC_NULL:
             /* those objects have similar semantics - fall through */
        case VQP_OBJ_MAC_ADDRESS:
        case VQP_OBJ_MAC_NULL:

+            if (vqp_obj_len != ETHER_ADDR_LEN)
+                goto trunc;

              ND_PRINT((ndo, "%s", etheraddr_string(ndo, tptr)));
               break;
         default:
              ND_PRINT((ndo, "%s", etheraddr_string(ndo, tptr)));
               break;
         default: