CVE-2016-7925/Add more bounds checks.

[tcpdump] / print-frag6.c

diff --git a/print-frag6.c b/print-frag6.c
index 6a85cfe267e9e0c73ebcb8ad3c38903d951a1c65..db4a98edcc3e40bb09bbb2a9cfe7917dac4d113a 100644 (file)
--- a/print-frag6.c
+++ b/print-frag6.c
@@ -19,82 +19,51 @@
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 

-#ifndef lint
-static const char rcsid[] =
-    "@(#) /master/usr.sbin/tcpdump/tcpdump/print-icmp.c,v 2.1 1995/02/03 18:14:42 polk Exp (LBL)";
-#endif
-
-#ifdef INET6
-
-#include <sys/param.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-
-#include <net/if.h>
-
-#include <netinet/in.h>
-#include <netinet/if_ether.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_icmp.h>
-#include <netinet/ip_var.h>
-#include <netinet/udp.h>
-#include <netinet/udp_var.h>
-#include <netinet/tcp.h>
+/* \summary: IPv6 fragmentation header printer */

 
 

-#include <stdio.h>
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif

 
 

-#include <netinet/ip6.h>
+#include <netdissect-stdinc.h>

 
 

-#include "interface.h"
-#include "addrtoname.h"
+#include "ip6.h"
+#include "netdissect.h"
+#include "extract.h"

 
 int
 
 int

-frag6_print(register const u_char *bp, register const u_char *bp2)
+frag6_print(netdissect_options *ndo, register const u_char *bp, register const u_char *bp2)

 {
        register const struct ip6_frag *dp;
        register const struct ip6_hdr *ip6;
 {
        register const struct ip6_frag *dp;
        register const struct ip6_hdr *ip6;

-       register const u_char *ep;
-
-#if 0
-#define TCHECK(var) if ((u_char *)&(var) >= ep - sizeof(var)) goto trunc
-#endif

 
 

-       dp = (struct ip6_frag *)bp;
-       ip6 = (struct ip6_hdr *)bp2;
+       dp = (const struct ip6_frag *)bp;
+       ip6 = (const struct ip6_hdr *)bp2;

 
 

-       /* 'ep' points to the end of avaible data. */
-       ep = snapend;
+       ND_TCHECK(dp->ip6f_offlg);

 
 

-       TCHECK(dp->ip6f_offlg);
-
-       if (vflag) {
-               printf("frag (0x%08x:%d|%d)",
-                      ntohl(dp->ip6f_ident),
-                      ntohs(dp->ip6f_offlg & IP6F_OFF_MASK),
-                      sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) -
-                              (bp - bp2) - sizeof(struct ip6_frag));
+       if (ndo->ndo_vflag) {
+               ND_PRINT((ndo, "frag (0x%08x:%d|%ld)",
+                      EXTRACT_32BITS(&dp->ip6f_ident),
+                      EXTRACT_16BITS(&dp->ip6f_offlg) & IP6F_OFF_MASK,
+                      sizeof(struct ip6_hdr) + EXTRACT_16BITS(&ip6->ip6_plen) -
+                              (long)(bp - bp2) - sizeof(struct ip6_frag)));

        } else {
        } else {

-               printf("frag (%d|%d)",
-                      ntohs(dp->ip6f_offlg & IP6F_OFF_MASK),
-                      sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen) -
-                              (bp - bp2) - sizeof(struct ip6_frag));
+               ND_PRINT((ndo, "frag (%d|%ld)",
+                      EXTRACT_16BITS(&dp->ip6f_offlg) & IP6F_OFF_MASK,
+                      sizeof(struct ip6_hdr) + EXTRACT_16BITS(&ip6->ip6_plen) -
+                              (long)(bp - bp2) - sizeof(struct ip6_frag)));

        }
 
        }
 

-#if 0

        /* it is meaningless to decode non-first fragment */
        /* it is meaningless to decode non-first fragment */

-       if (ntohs(dp->ip6f_offlg & IP6F_OFF_MASK) != 0)
-               return 65535;
+       if ((EXTRACT_16BITS(&dp->ip6f_offlg) & IP6F_OFF_MASK) != 0)
+               return -1;

        else
        else

-#endif

        {
        {

-               fputs(" ", stdout);
+               ND_PRINT((ndo, " "));

                return sizeof(struct ip6_frag);
        }
 trunc:
                return sizeof(struct ip6_frag);
        }
 trunc:

-       fputs("[|frag]", stdout);
-       return 65535;
-#undef TCHECK
+       ND_PRINT((ndo, "[|frag]"));
+       return -1;

 }
 }

-#endif /* INET6 */