Audit DNS printer for buffer overflows. Use TTEST2() in tests, and make

some additional tests (some of which might, in theory, be unnecessary,
but...).  Check for null pointers *before* checking whether there's
enough data at the pointer in question.

diff --git a/print-domain.c b/print-domain.c
index efde6a4fc16f0c3debf2900eaa38ccea6a4c4e2f..c0a4be5bf5d6512136af08fcbfbe60911ce08e2d 100644 (file)
--- a/print-domain.c
+++ b/print-domain.c
@@ -21,7 +21,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-domain.c,v 1.74 2001-02-21 08:52:30 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-domain.c,v 1.75 2001-02-23 08:55:21 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -67,24 +67,26 @@ ns_nskip(register const u_char *cp, register const u_char *bp)
 {
        register u_char i;
 
+       if (!TTEST2(*cp, 1))
+               return (NULL);
        if (((i = *cp++) & INDIR_MASK) == INDIR_MASK)
                return (cp + 1);
-       if (cp >= snapend)
-               return(NULL);
-       while (i && cp < snapend) {
+       while (i) {
                if ((i & INDIR_MASK) == EDNS0_MASK) {
                        int bitlen, bytelen;
 
                        if ((i & ~INDIR_MASK) != EDNS0_ELT_BITLABEL)
                                return(NULL); /* unknown ELT */
+                       if (!TTEST2(*cp, 1))
+                               return (NULL);
                        if ((bitlen = *cp++) == 0)
                                bitlen = 256;
                        bytelen = (bitlen + 7) / 8;
                        cp += bytelen;
                } else
                        cp += i;
-               if (cp >= snapend)
-                       return(NULL);
+               if (!TTEST2(*cp, 1))
+                       return (NULL);
                i = *cp++;
        }
        return (cp);
@@ -99,7 +101,7 @@ blabel_print(const u_char *cp)
        const u_char *bitp, *lim;
        char tc;
 
-       if (cp >= snapend)
+       if (!TTEST2(*cp, 1))
                return(NULL);
        if ((bitlen = *cp) == 0)
                bitlen = 256;
@@ -132,7 +134,7 @@ labellen(const u_char *cp)
 {
        register u_int i;
 
-       if (cp >= snapend)
+       if (!TTEST2(*cp, 1))
                return(-1);
        i = *cp;
        if ((i & INDIR_MASK) == EDNS0_MASK) {
@@ -140,7 +142,7 @@ labellen(const u_char *cp)
 
                if ((elt = (i & ~INDIR_MASK)) != EDNS0_ELT_BITLABEL)
                        return(-1);
-               if (cp + 1 >= snapend)
+               if (!TTEST2(*(cp + 1), 1))
                        return(-1);
                if ((bitlen = *(cp + 1)) == 0)
                        bitlen = 256;
@@ -161,7 +163,7 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
 
        if ((l = labellen(cp)) < 0)
                return(NULL);
-       if (cp >= snapend)
+       if (!TTEST2(*cp, 1))
                return(NULL);
        chars_processed = 1;
        if (((i = *cp++) & INDIR_MASK) != INDIR_MASK) {
@@ -176,11 +178,13 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
                                        rp = cp + 1;
                                        compress = 1;
                                }
-                               cp = bp + (((i << 8) | *cp) & 0x3fff);
-                               if (cp >= snapend)
+                               if (!TTEST2(*cp, 1))
                                        return(NULL);
+                               cp = bp + (((i << 8) | *cp) & 0x3fff);
                                if ((l = labellen(cp)) < 0)
                                        return(NULL);
+                               if (!TTEST2(*cp, 1))
+                                       return(NULL);
                                i = *cp++;
                                chars_processed++;
 
@@ -200,7 +204,8 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
                                elt = (i & ~INDIR_MASK);
                                switch(elt) {
                                case EDNS0_ELT_BITLABEL:
-                                       blabel_print(cp);
+                                       if (blabel_print(cp) == NULL)
+                                               return (NULL);
                                        break;
                                default:
                                        /* unknown ELT */
@@ -209,13 +214,15 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
                                }
                        } else {
                                if (fn_printn(cp, l, snapend))
-                                       break;
+                                       return(NULL);
                        }
 
                        cp += l;
                        chars_processed += l;
                        putchar('.');
-                       if (cp >= snapend || (l = labellen(cp)) < 0)
+                       if ((l = labellen(cp)) < 0)
+                               return(NULL);
+                       if (!TTEST2(*cp, 1))
                                return(NULL);
                        i = *cp++;
                        chars_processed++;
@@ -233,10 +240,11 @@ ns_cprint(register const u_char *cp, register const u_char *bp)
 {
        register u_int i;
 
-       if (cp >= snapend)
-               return NULL;
+       if (!TTEST2(*cp, 1))
+               return (NULL);
        i = *cp++;
-       (void)fn_printn(cp, i, snapend);
+       if (fn_printn(cp, i, snapend))
+               return (NULL);
        return (cp + i);
 }
 
@@ -311,7 +319,7 @@ ns_qprint(register const u_char *cp, register const u_char *bp)
 
        cp = ns_nskip(cp, bp);
 
-       if (cp + 4 > snapend || cp == NULL)
+       if (cp == NULL || !TTEST2(*cp, 4))
                return(NULL);
 
        /* print the qtype and qclass (if it's not IN) */
@@ -343,7 +351,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
        } else
                cp = ns_nskip(cp, bp);
 
-       if (cp + 10 > snapend || cp == NULL)
+       if (cp == NULL || !TTEST2(*cp, 10))
                return (snapend);
 
        /* print the type/qtype and class (if it's not IN) */
@@ -368,7 +376,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 
        switch (typ) {
        case T_A:
-               if (cp + sizeof(struct in_addr) > snapend)
+               if (!TTEST2(*cp, sizeof(struct in_addr)))
                        return(NULL);
                printf(" %s", ipaddr_string(cp));
                break;
@@ -393,7 +401,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
                putchar(' ');
                if ((cp = ns_nprint(cp, bp)) == NULL)
                        return(NULL);
-               if (cp + 5 * 4 > snapend)
+               if (!TTEST2(*cp, 5 * 4))
                        return(NULL);
                printf(" %u", EXTRACT_32BITS(cp));
                cp += 4;
@@ -408,7 +416,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
                break;
        case T_MX:
                putchar(' ');
-               if (cp + 2 > snapend)
+               if (!TTEST2(*cp, 2))
                        return(NULL);
                if (ns_nprint(cp + 2, bp) == NULL)
                        return(NULL);
@@ -422,7 +430,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 
 #ifdef INET6
        case T_AAAA:
-               if (cp + sizeof(struct in6_addr) > snapend)
+               if (!TTEST2(*cp, sizeof(struct in6_addr)))
                        return(NULL);
                printf(" %s", ip6addr_string(cp));
                break;
@@ -432,12 +440,16 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
                struct in6_addr a;
                int pbit, pbyte;
 
+               if (!TTEST2(*cp, 1))
+                       return(NULL);
                pbit = *cp;
                pbyte = (pbit & ~7) / 8;
                if (pbit > 128) {
                        printf(" %u(bad plen)", pbit);
                        break;
                } else if (pbit < 128) {
+                       if (!TTEST2(*(cp + 1), sizeof(a) - pbyte))
+                               return(NULL);
                        memset(&a, 0, sizeof(a));
                        memcpy(&a.s6_addr[pbyte], cp + 1, sizeof(a) - pbyte);
                        printf(" %u %s", pbit, ip6addr_string(&a));
@@ -456,9 +468,10 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
                break;
 
        case T_UNSPECA:         /* One long string */
-               if (cp + len > snapend)
+               if (!TTEST2(*cp, len))
+                       return(NULL);
+               if (fn_printn(cp, len, snapend))
                        return(NULL);
-               fn_printn(cp, len, snapend);
                break;
 
        case T_TSIG:
@@ -471,14 +484,24 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
                if ((cp = ns_nprint(cp, bp)) == NULL)
                        return(NULL);
                cp += 6;
+               if (!TTEST2(*cp, 2))
+                       return(NULL);
                printf(" fudge=%u", EXTRACT_16BITS(cp));
                cp += 2;
+               if (!TTEST2(*cp, 2))
+                       return(NULL);
                printf(" maclen=%u", EXTRACT_16BITS(cp));
                cp += 2 + EXTRACT_16BITS(cp);
+               if (!TTEST2(*cp, 2))
+                       return(NULL);
                printf(" origid=%u", EXTRACT_16BITS(cp));
                cp += 2;
+               if (!TTEST2(*cp, 2))
+                       return(NULL);
                printf(" error=%u", EXTRACT_16BITS(cp));
                cp += 2;
+               if (!TTEST2(*cp, 2))
+                       return(NULL);
                printf(" otherlen=%u", EXTRACT_16BITS(cp));
                cp += 2;
            }