CVE-2017-13000/IEEE 802.15.4: Fix bug introduced two fixes prior.

We've already advanced the pointer past the PAN ID, if present; it now
points to the address, so don't add 2 to it.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).

diff --git a/print-802_15_4.c b/print-802_15_4.c
index a7817eb5afda6ccc658492b304b164d04e2a0493..1c77da8af16b7835fbe82109f4d7dc36128b7df4 100644 (file)
--- a/print-802_15_4.c
+++ b/print-802_15_4.c
@@ -122,7 +122,7 @@ ieee802_15_4_if_print(netdissect_options *ndo,
                        return hdrlen;
                }
                if (ndo->ndo_vflag)
-                       ND_PRINT((ndo,"%04x:%04x ", panid, EXTRACT_LE_16BITS(p + 2)));
+                       ND_PRINT((ndo,"%04x:%04x ", panid, EXTRACT_LE_16BITS(p)));
                p += 2;
                caplen -= 2;
                hdrlen += 2;

diff --git a/tests/802_15_4_beacon.out b/tests/802_15_4_beacon.out
new file mode 100644 (file)
index 0000000..125f46d
--- /dev/null
+++ b/tests/802_15_4_beacon.out
@@ -0,0 +1 @@
+IEEE 802.15.4 Beacon packet seq cd ffab:cdff < [|802.15.4]

diff --git a/tests/802_15_4_beacon.pcap b/tests/802_15_4_beacon.pcap
new file mode 100644 (file)
index 0000000..9e6aafe
Binary files /dev/null and b/tests/802_15_4_beacon.pcap differ

diff --git a/tests/TESTLIST b/tests/TESTLIST
index be914a4a9b2642434ddadca8a87fd7e5b37a3af8..548af8f30bd79d8d8d06ea8e568a2e0739246830 100644 (file)
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -489,6 +489,7 @@ pimv2-oobr-4                pimv2-oobr-4.pcap               pimv2-oobr-4.out                -vvv -e
 802_15_4-oobr-1                802_15_4-oobr-1.pcap            802_15_4-oobr-1.out     -vvv -e
 802_15_4-oobr-2                802_15_4-oobr-2.pcap            802_15_4-oobr-2.out     -vvv -e
 802_15_4-data          802_15_4-data.pcap              802_15_4-data.out       -vvv -e
+802_15_4_beacon                802_15_4_beacon.pcap            802_15_4_beacon.out     -vvv -e
 
 # RTP tests
 # fuzzed pcap