CVE-2017-13029/PPP: Fix a bounds check, and clean up other bounds checks.

[tcpdump] / print-pim.c

diff --git a/print-pim.c b/print-pim.c
index 1c1050b1dfc3b7d856881fdc6daf0d18ecc58e41..ee18d958132e84d3b5e0f5afebc59fac63eb423e 100644 (file)
--- a/print-pim.c
+++ b/print-pim.c
@@ -19,18 +19,21 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
+/* \summary: Protocol Independent Multicast (PIM) printer */
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
 
-#include <tcpdump-stdinc.h>
+#include <netdissect-stdinc.h>
 
-#include "interface.h"
+#include "netdissect.h"
 #include "addrtoname.h"
 #include "extract.h"
 
 #include "ip.h"
 #include "ip6.h"
+#include "ipproto.h"
 
 #define PIMV1_TYPE_QUERY           0
 #define PIMV1_TYPE_REGISTER        1
@@ -152,7 +155,7 @@ pimv1_join_prune_print(netdissect_options *ndo,
                hold = EXTRACT_16BITS(&bp[6]);
                if (hold != 180) {
                        ND_PRINT((ndo, "Hold "));
-                       relts_print(ndo, hold);
+                       unsigned_relts_print(ndo, hold);
                }
                ND_PRINT((ndo, "%s (%s/%d, %s", njoin ? "Join" : "Prune",
                ipaddr_string(ndo, &bp[26]), bp[25] & 0x3f,
@@ -174,7 +177,7 @@ pimv1_join_prune_print(netdissect_options *ndo,
        if (ndo->ndo_vflag > 1)
                ND_PRINT((ndo, "\n"));
        ND_PRINT((ndo, " Hold time: "));
-       relts_print(ndo, EXTRACT_16BITS(&bp[6]));
+       unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[6]));
        if (ndo->ndo_vflag < 2)
                return;
        bp += 8;
@@ -259,7 +262,7 @@ pimv1_print(netdissect_options *ndo,
                if (ndo->ndo_vflag) {
                        ND_TCHECK2(bp[10],2);
                        ND_PRINT((ndo, " (Hold-time "));
-                       relts_print(ndo, EXTRACT_16BITS(&bp[10]));
+                       unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[10]));
                        ND_PRINT((ndo, ")"));
                }
                break;
@@ -281,7 +284,7 @@ pimv1_print(netdissect_options *ndo,
                        if (EXTRACT_32BITS(&bp[12]) != 0xffffffff)
                                ND_PRINT((ndo, "/%s", ipaddr_string(ndo, &bp[12])));
                        ND_PRINT((ndo, " RP %s hold ", ipaddr_string(ndo, &bp[16])));
-                       relts_print(ndo, EXTRACT_16BITS(&bp[22]));
+                       unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[22]));
                }
                break;
        case PIMV1_TYPE_ASSERT:
@@ -303,6 +306,7 @@ pimv1_print(netdissect_options *ndo,
                        pimv1_join_prune_print(ndo, &bp[8], len - 8);
                break;
        }
+       ND_TCHECK(bp[4]);
        if ((bp[4] >> 4) != 1)
                ND_PRINT((ndo, " [v%d]", bp[4] >> 4));
        return;
@@ -348,7 +352,7 @@ cisco_autorp_print(netdissect_options *ndo,
        ND_PRINT((ndo, " Hold "));
        hold = EXTRACT_16BITS(&bp[2]);
        if (hold)
-               relts_print(ndo, EXTRACT_16BITS(&bp[2]));
+               unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[2]));
        else
                ND_PRINT((ndo, "FOREVER"));
 
@@ -534,12 +538,10 @@ pimv2_addr_print(netdissect_options *ndo,
                        af = AF_INET;
                        len = sizeof(struct in_addr);
                        break;
-#ifdef INET6
                case 2:
                        af = AF_INET6;
                        len = sizeof(struct in6_addr);
                        break;
-#endif
                default:
                        return -1;
                }
@@ -551,11 +553,9 @@ pimv2_addr_print(netdissect_options *ndo,
                case sizeof(struct in_addr):
                        af = AF_INET;
                        break;
-#ifdef INET6
                case sizeof(struct in6_addr):
                        af = AF_INET6;
                        break;
-#endif
                default:
                        return -1;
                        break;
@@ -572,12 +572,10 @@ pimv2_addr_print(netdissect_options *ndo,
                        if (!silent)
                                ND_PRINT((ndo, "%s", ipaddr_string(ndo, bp)));
                }
-#ifdef INET6
                else if (af == AF_INET6) {
                        if (!silent)
                                ND_PRINT((ndo, "%s", ip6addr_string(ndo, bp)));
                }
-#endif
                return hdrlen + len;
        case pimv2_group:
        case pimv2_source:
@@ -589,7 +587,6 @@ pimv2_addr_print(netdissect_options *ndo,
                                        ND_PRINT((ndo, "/%u", bp[1]));
                        }
                }
-#ifdef INET6
                else if (af == AF_INET6) {
                        if (!silent) {
                                ND_PRINT((ndo, "%s", ip6addr_string(ndo, bp + 2)));
@@ -597,7 +594,6 @@ pimv2_addr_print(netdissect_options *ndo,
                                        ND_PRINT((ndo, "/%u", bp[1]));
                        }
                }
-#endif
                if (bp[0] && !silent) {
                        if (at == pimv2_group) {
                                ND_PRINT((ndo, "(0x%02x)", bp[0]));
@@ -627,11 +623,16 @@ enum checksum_status {
 };
 
 static enum checksum_status
-pimv2_check_checksum(const u_char *bp, const u_char *bp2, u_int len)
+pimv2_check_checksum(netdissect_options *ndo, const u_char *bp,
+                    const u_char *bp2, u_int len)
 {
        const struct ip *ip;
        u_int cksum;
 
+       if (!ND_TTEST2(bp[0], len)) {
+               /* We don't have all the data. */
+               return (UNVERIFIED);
+       }
        ip = (const struct ip *)bp2;
        if (IP_V(ip) == 4) {
                struct cksum_vec vec[1];
@@ -640,14 +641,12 @@ pimv2_check_checksum(const u_char *bp, const u_char *bp2, u_int len)
                vec[0].len = len;
                cksum = in_cksum(vec, 1);
                return (cksum ? INCORRECT : CORRECT);
-#ifdef INET6
        } else if (IP_V(ip) == 6) {
                const struct ip6_hdr *ip6;
 
                ip6 = (const struct ip6_hdr *)bp2;
-               cksum = nextproto6_cksum(ip6, bp, len, len, IPPROTO_PIM);
+               cksum = nextproto6_cksum(ndo, ip6, bp, len, len, IPPROTO_PIM);
                return (cksum ? INCORRECT : CORRECT);
-#endif
        } else {
                return (UNVERIFIED);
        }
@@ -681,7 +680,7 @@ pimv2_print(netdissect_options *ndo,
                         * The checksum only covers the packet header,
                         * not the encapsulated packet.
                         */
-                       cksum_status = pimv2_check_checksum(bp, bp2, 8);
+                       cksum_status = pimv2_check_checksum(ndo, bp, bp2, 8);
                        if (cksum_status == INCORRECT) {
                                /*
                                 * To quote RFC 4601, "For interoperability
@@ -689,13 +688,13 @@ pimv2_print(netdissect_options *ndo,
                                 * calculated over the entire PIM Register
                                 * message should also be accepted."
                                 */
-                               cksum_status = pimv2_check_checksum(bp, bp2, len);
+                               cksum_status = pimv2_check_checksum(ndo, bp, bp2, len);
                        }
                } else {
                        /*
                         * The checksum covers the entire packet.
                         */
-                       cksum_status = pimv2_check_checksum(bp, bp2, len);
+                       cksum_status = pimv2_check_checksum(ndo, bp, bp2, len);
                }
                switch (cksum_status) {
 
@@ -731,7 +730,11 @@ pimv2_print(netdissect_options *ndo,
 
                        switch (otype) {
                        case PIMV2_HELLO_OPTION_HOLDTIME:
-                               relts_print(ndo, EXTRACT_16BITS(bp));
+                               if (olen != 2) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 2 Bytes (%u)", olen));
+                               } else {
+                                       unsigned_relts_print(ndo, EXTRACT_16BITS(bp));
+                               }
                                break;
 
                        case PIMV2_HELLO_OPTION_LANPRUNEDELAY:
@@ -765,17 +768,25 @@ pimv2_print(netdissect_options *ndo,
                                break;
 
                        case PIMV2_HELLO_OPTION_GENID:
-                               ND_PRINT((ndo, "0x%08x", EXTRACT_32BITS(bp)));
+                               if (olen != 4) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 4 Bytes (%u)", olen));
+                               } else {
+                                       ND_PRINT((ndo, "0x%08x", EXTRACT_32BITS(bp)));
+                               }
                                break;
 
                        case PIMV2_HELLO_OPTION_REFRESH_CAP:
-                               ND_PRINT((ndo, "v%d", *bp));
-                               if (*(bp+1) != 0) {
-                                       ND_PRINT((ndo, ", interval "));
-                                       relts_print(ndo, *(bp+1));
-                               }
-                               if (EXTRACT_16BITS(bp+2) != 0) {
-                                       ND_PRINT((ndo, " ?0x%04x?", EXTRACT_16BITS(bp+2)));
+                               if (olen != 4) {
+                                       ND_PRINT((ndo, "ERROR: Option Length != 4 Bytes (%u)", olen));
+                               } else {
+                                       ND_PRINT((ndo, "v%d", *bp));
+                                       if (*(bp+1) != 0) {
+                                               ND_PRINT((ndo, ", interval "));
+                                               unsigned_relts_print(ndo, *(bp+1));
+                                       }
+                                       if (EXTRACT_16BITS(bp+2) != 0) {
+                                               ND_PRINT((ndo, " ?0x%04x?", EXTRACT_16BITS(bp+2)));
+                                       }
                                }
                                break;
 
@@ -934,7 +945,7 @@ pimv2_print(netdissect_options *ndo,
                        if (holdtime == 0xffff)
                                ND_PRINT((ndo, "infinite"));
                        else
-                               relts_print(ndo, holdtime);
+                               unsigned_relts_print(ndo, holdtime);
                }
                bp += 4; len -= 4;
                for (i = 0; i < ngroup; i++) {
@@ -1038,7 +1049,7 @@ pimv2_print(netdissect_options *ndo,
                                        goto bs_done;
                                }
                                ND_PRINT((ndo, ",holdtime="));
-                               relts_print(ndo, EXTRACT_16BITS(bp));
+                               unsigned_relts_print(ndo, EXTRACT_16BITS(bp));
                                if (bp + 2 >= ep) {
                                        ND_PRINT((ndo, "...)"));
                                        goto bs_done;
@@ -1090,7 +1101,7 @@ pimv2_print(netdissect_options *ndo,
                ND_PRINT((ndo, " prio=%d", bp[1]));
                if (bp + 3 >= ep) break;
                ND_PRINT((ndo, " holdtime="));
-               relts_print(ndo, EXTRACT_16BITS(&bp[2]));
+               unsigned_relts_print(ndo, EXTRACT_16BITS(&bp[2]));
                bp += 4;
 
                /* Encoded-Unicast-RP-Address */
@@ -1136,7 +1147,7 @@ pimv2_print(netdissect_options *ndo,
                bp += advance;
                ND_TCHECK2(bp[0], 2);
                ND_PRINT((ndo, " TUNR "));
-               relts_print(ndo, EXTRACT_16BITS(bp));
+               unsigned_relts_print(ndo, EXTRACT_16BITS(bp));
                break;