Add bounds checks.

diff --git a/print-ppp.c b/print-ppp.c
index 939bd2d6b98387b3061939598e4e1aa8d5496180..d4fb4f29b2ca772d79d6ab48fca2b0d59302d203 100644 (file)
--- a/print-ppp.c
+++ b/print-ppp.c
@@ -31,7 +31,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-ppp.c,v 1.93 2004-03-18 10:59:15 hannes Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-ppp.c,v 1.94 2004-03-24 03:30:06 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -375,6 +375,7 @@ static void handle_ppp (u_int proto, const u_char *p, int length);
 static void
 handle_ctrl_proto(u_int proto, const u_char *pptr, int length)
 {
+       const char *typestr;
        u_int code, len;
        int (*pfunc)(const u_char *, int);
        int x, j;
@@ -382,10 +383,12 @@ handle_ctrl_proto(u_int proto, const u_char *pptr, int length)
 
         tptr=pptr;
 
-        printf("%s, ",tok2str(ppptype2str, "unknown", proto));
+        typestr = tok2str(ppptype2str, "unknown", proto);
+        printf("%s, ",typestr);
 
        if (length < 4) /* FIXME weak boundary checking */
-               return;
+               goto trunc;
+       TCHECK2(*tptr, 2);
 
        code = *tptr++;
        
@@ -394,6 +397,7 @@ handle_ctrl_proto(u_int proto, const u_char *pptr, int length)
               code,
                *tptr++); /* ID */
 
+       TCHECK2(*tptr, 2);
        len = EXTRACT_16BITS(tptr);
        tptr += 2;
 
@@ -404,8 +408,10 @@ handle_ctrl_proto(u_int proto, const u_char *pptr, int length)
        case CPCODES_VEXT:
                if (length < 11)
                        break;
+               TCHECK2(*tptr, 4);
                printf(", Magic-Num 0x%08x", EXTRACT_32BITS(tptr));
                tptr += 4;
+               TCHECK2(*tptr, 3);
                printf(" Vendor: %s (%u)",
                        tok2str(oui_values,"Unknown",EXTRACT_24BITS(tptr)),
                        EXTRACT_24BITS(tptr));
@@ -456,6 +462,7 @@ handle_ctrl_proto(u_int proto, const u_char *pptr, int length)
        case CPCODES_PROT_REJ:
                if (length < 6)
                        break;
+               TCHECK2(*tptr, 2);
                printf(", Rejected %s Protocol (0x%04x)",
                       tok2str(ppptype2str,"unknown", EXTRACT_16BITS(tptr)),
                       EXTRACT_16BITS(tptr));
@@ -467,13 +474,16 @@ handle_ctrl_proto(u_int proto, const u_char *pptr, int length)
        case CPCODES_ID:
                if (length < 8)
                        break;
+               TCHECK2(*tptr, 4);
                printf(", Magic-Num 0x%08x", EXTRACT_32BITS(tptr));
                /* XXX: need to decode Data? */
                break;
        case CPCODES_TIME_REM:
                if (length < 12)
                        break;
+               TCHECK2(*tptr, 4);
                printf(", Magic-Num 0x%08x", EXTRACT_32BITS(tptr));
+               TCHECK2(*(tptr + 4), 4);
                printf(", Seconds-Remaining %us", EXTRACT_32BITS(tptr + 4));
                /* XXX: need to decode Message? */
                break;
@@ -489,6 +499,10 @@ handle_ctrl_proto(u_int proto, const u_char *pptr, int length)
 
         if (vflag >1)
             print_unknown_data(pptr-2,"\n\t",length+2);
+       return;
+
+trunc:
+       printf("[|%s]", typestr);
 }
 
 /* LCP config options */
@@ -499,6 +513,7 @@ print_lcp_config_options(const u_char *p, int length)
 
        if (length < 2)
                return 0;
+       TCHECK2(*p, 2);
        len = p[1];
        opt = p[0];
        if (length < len)
@@ -513,34 +528,43 @@ print_lcp_config_options(const u_char *p, int length)
        switch (opt) {
        case LCPOPT_VEXT:
                if (len >= 6) {
+                       TCHECK2(*(p + 2), 3);
                        printf(" Vendor: %s (%u)",
                                tok2str(oui_values,"Unknown",EXTRACT_24BITS(p+2)),
                                EXTRACT_24BITS(p+2));
 #if 0
+                       TCHECK(p[5]);
                        printf(", kind: 0x%02x", p[5]);
                        printf(", Value: 0x")
                        for (i = 0; i < len - 6; i++) {
+                               TCHECK(p[6 + i]);
                                printf("%02x", p[6 + i]);
                        }
 #endif
                }
                break;
        case LCPOPT_MRU:
-               if (len == 4)
+               if (len == 4) {
+                       TCHECK2(*(p + 2), 2);
                        printf(" %u", EXTRACT_16BITS(p + 2));
+               }
                break;
        case LCPOPT_ACCM:
-               if (len == 6)
+               if (len == 6) {
+                       TCHECK2(*(p + 2), 4);
                        printf(" 0x%08x", EXTRACT_32BITS(p + 2));
+               }
                break;
        case LCPOPT_AP:
                if (len >= 4) {
+                   TCHECK2(*(p + 2), 2);
                    switch (EXTRACT_16BITS(p+2)) {
                    case PPP_PAP:
                        printf(" PAP");
                        break;
                    case PPP_CHAP:
                        printf(" CHAP");
+                       TCHECK(p[4]);
                        switch (p[4]) {
                        default:
                            printf(", unknown-algorithm-%u", p[4]);
@@ -572,6 +596,7 @@ print_lcp_config_options(const u_char *p, int length)
                break;
        case LCPOPT_QP:
                if (len >= 4) {
+                       TCHECK2(*(p + 2), 2);
                        if (EXTRACT_16BITS(p+2) == PPP_LQM)
                                printf(" LQR");
                        else
@@ -579,20 +604,25 @@ print_lcp_config_options(const u_char *p, int length)
                }
                break;
        case LCPOPT_MN:
-               if (len == 6)
+               if (len == 6) {
+                       TCHECK2(*(p + 2), 4);
                        printf(" 0x%08x", EXTRACT_32BITS(p + 2));
+               }
                break;
        case LCPOPT_PFC:
                break;
        case LCPOPT_ACFC:
                break;
        case LCPOPT_LD:
-               if (len == 4)
+               if (len == 4) {
+                       TCHECK2(*(p + 2), 2);
                        printf(" 0x%04x", EXTRACT_16BITS(p + 2));
+               }
                break;
        case LCPOPT_CBACK:
                if (len < 3)
                        break;
+               TCHECK(p[2]);
                switch (p[2]) {         /* Operation */
                case CALLBACK_AUTH:
                        printf(" UserAuth");
@@ -618,12 +648,15 @@ print_lcp_config_options(const u_char *p, int length)
                }
                break;
        case LCPOPT_MLMRRU:
-               if (len == 4)
+               if (len == 4) {
+                       TCHECK2(*(p + 2), 2);
                        printf(" %u", EXTRACT_16BITS(p + 2));
+               }
                break;
        case LCPOPT_MLED:
                if (len < 3)
                        break;
+               TCHECK(p[2]);
                switch (p[2]) {         /* class */
                case MEDCLASS_NULL:
                        printf(" Null");
@@ -634,11 +667,13 @@ print_lcp_config_options(const u_char *p, int length)
                case MEDCLASS_IPV4:
                        if (len != 7)
                                break;
+                       TCHECK2(*(p + 3), 4);
                        printf(" IPv4 %s", ipaddr_string(p + 3));
                        break;
                case MEDCLASS_MAC:
                        if (len != 9)
                                break;
+                       TCHECK(p[8]);
                        printf(" MAC %02x:%02x:%02x:%02x:%02x:%02x",
                               p[3], p[4], p[5], p[6], p[7], p[8]);
                        break;
@@ -676,6 +711,10 @@ print_lcp_config_options(const u_char *p, int length)
 #endif
        }
        return len;
+
+trunc:
+       printf("[|lcp]");
+       return 0;
 }
 
 /* CHAP */
@@ -692,10 +731,12 @@ handle_chap(const u_char *p, int length)
                printf("[|chap]");
                return;
        } else if (length < 4) {
+               TCHECK(*p);
                printf("[|chap 0x%02x]", *p);
                return;
        }
 
+       TCHECK(*p);
        code = *p;
        if ((code >= CHAP_CODEMIN) && (code <= CHAP_CODEMAX))
                printf("%s", chapcode[code - 1]);
@@ -705,9 +746,11 @@ handle_chap(const u_char *p, int length)
        }
        p++;
 
+       TCHECK(*p);
        printf("(%u)", *p);             /* ID */
        p++;
 
+       TCHECK2(*p, 2);
        len = EXTRACT_16BITS(p);
        p += 2;
 
@@ -723,26 +766,37 @@ handle_chap(const u_char *p, int length)
        case CHAP_RESP:
                if (length - (p - p0) < 1)
                        return;
+               TCHECK(*p);
                val_size = *p;          /* value size */
                p++;
                if (length - (p - p0) < val_size)
                        return;
                printf(", Value ");
-               for (i = 0; i < val_size; i++)
+               for (i = 0; i < val_size; i++) {
+                       TCHECK(*p);
                        printf("%02x", *p++);
+               }
                name_size = len - (p - p0);
                printf(", Name ");
-               for (i = 0; i < name_size; i++)
+               for (i = 0; i < name_size; i++) {
+                       TCHECK(*p);
                        safeputchar(*p++);
+               }
                break;
        case CHAP_SUCC:
        case CHAP_FAIL:
                msg_size = len - (p - p0);
                printf(", Msg ");
-               for (i = 0; i< msg_size; i++)
+               for (i = 0; i< msg_size; i++) {
+                       TCHECK(*p);
                        safeputchar(*p++);
+               }
                break;
        }
+       return;
+
+trunc:
+       printf("[|chap]");
 }
 
 /* PAP (see RFC 1334) */
@@ -759,10 +813,12 @@ handle_pap(const u_char *p, int length)
                printf("[|pap]");
                return;
        } else if (length < 4) {
+               TCHECK(*p);
                printf("[|pap 0x%02x]", *p);
                return;
        }
 
+       TCHECK(*p);
        code = *p;
        if ((code >= PAP_CODEMIN) && (code <= PAP_CODEMAX))
                printf("%s", papcode[code - 1]);
@@ -772,9 +828,11 @@ handle_pap(const u_char *p, int length)
        }
        p++;
 
+       TCHECK(*p);
        printf("(%u)", *p);             /* ID */
        p++;
 
+       TCHECK2(*p, 2);
        len = EXTRACT_16BITS(p);
        p += 2;
 
@@ -782,38 +840,50 @@ handle_pap(const u_char *p, int length)
        case PAP_AREQ:
                if (length - (p - p0) < 1)
                        return;
+               TCHECK(*p);
                peerid_len = *p;        /* Peer-ID Length */
                p++;
                if (length - (p - p0) < peerid_len)
                        return;
                printf(", Peer ");
-               for (i = 0; i < peerid_len; i++)
+               for (i = 0; i < peerid_len; i++) {
+                       TCHECK(*p);
                        safeputchar(*p++);
+               }
 
                if (length - (p - p0) < 1)
                        return;
+               TCHECK(*p);
                passwd_len = *p;        /* Password Length */
                p++;
                if (length - (p - p0) < passwd_len)
                        return;
                printf(", Name ");
-               for (i = 0; i < passwd_len; i++)
+               for (i = 0; i < passwd_len; i++) {
+                       TCHECK(*p);
                        safeputchar(*p++);
+               }
                break;
        case PAP_AACK:
        case PAP_ANAK:
                if (length - (p - p0) < 1)
                        return;
+               TCHECK(*p);
                msg_len = *p;           /* Msg-Length */
                p++;
                if (length - (p - p0) < msg_len)
                        return;
                printf(", Msg ");
-               for (i = 0; i< msg_len; i++)
+               for (i = 0; i< msg_len; i++) {
+                       TCHECK(*p);
                        safeputchar(*p++);
+               }
                break;
        }
        return;
+
+trunc:
+       printf("[|pap]");
 }
 
 /* BAP */
@@ -832,6 +902,7 @@ print_ipcp_config_options(const u_char *p, int length)
 
        if (length < 2)
                return 0;
+       TCHECK2(*p, 2);
        len = p[1];
        opt = p[0];
        if (length < len)
@@ -840,6 +911,7 @@ print_ipcp_config_options(const u_char *p, int length)
        case IPCPOPT_2ADDR:             /* deprecated */
                if (len != 10)
                        goto invlen;
+               TCHECK2(*(p + 6), 4);
                printf(", IP-Addrs src %s, dst %s",
                       ipaddr_string(p + 2),
                       ipaddr_string(p + 6));
@@ -848,6 +920,7 @@ print_ipcp_config_options(const u_char *p, int length)
                if (len < 4)
                        goto invlen;
                printf(", IP-Comp");
+               TCHECK2(*(p + 2), 2);
                if (EXTRACT_16BITS(p + 2) == PPP_VJC) {
                        printf(" VJ-Comp");
                        /* XXX: VJ-Comp parameters should be decoded */
@@ -857,31 +930,37 @@ print_ipcp_config_options(const u_char *p, int length)
        case IPCPOPT_ADDR:
                if (len != 6)
                        goto invlen;
+               TCHECK2(*(p + 2), 4);
                printf(", IP-Addr %s", ipaddr_string(p + 2));
                break;
        case IPCPOPT_MOBILE4:
                if (len != 6)
                        goto invlen;
+               TCHECK2(*(p + 2), 4);
                printf(", Home-Addr %s", ipaddr_string(p + 2));
                break;
        case IPCPOPT_PRIDNS:
                if (len != 6)
                        goto invlen;
+               TCHECK2(*(p + 2), 4);
                printf(", Pri-DNS %s", ipaddr_string(p + 2));
                break;
        case IPCPOPT_PRINBNS:
                if (len != 6)
                        goto invlen;
+               TCHECK2(*(p + 2), 4);
                printf(", Pri-NBNS %s", ipaddr_string(p + 2));
                break;
        case IPCPOPT_SECDNS:
                if (len != 6)
                        goto invlen;
+               TCHECK2(*(p + 2), 4);
                printf(", Sec-DNS %s", ipaddr_string(p + 2));
                break;
        case IPCPOPT_SECNBNS:
                if (len != 6)
                        goto invlen;
+               TCHECK2(*(p + 2), 4);
                printf(", Sec-NBNS %s", ipaddr_string(p + 2));
                break;
        default:
@@ -893,6 +972,10 @@ print_ipcp_config_options(const u_char *p, int length)
 invlen:
        printf(", invalid-length-%d", opt);
        return 0;
+
+trunc:
+       printf("[|ipcp]");
+       return 0;
 }
 
 /* CCP config options */
@@ -903,6 +986,7 @@ print_ccp_config_options(const u_char *p, int length)
 
        if (length < 2)
                return 0;
+       TCHECK2(*p, 2);
        len = p[1];
        opt = p[0];
        if (length < len)
@@ -934,6 +1018,10 @@ print_ccp_config_options(const u_char *p, int length)
        }
 #endif
        return len;
+
+trunc:
+       printf("[|ccp]");
+       return 0;
 }
 
 /* BACP config options */
@@ -944,17 +1032,23 @@ print_bacp_config_options(const u_char *p, int length)
 
        if (length < 2)
                return 0;
+       TCHECK2(*p, 2);
        len = p[1];
        opt = p[0];
        if (length < len)
                return 0;
        if (opt == BACPOPT_FPEER) {
+               TCHECK2(*(p + 2), 4);
                printf(", Favored-Peer");
                printf(", Magic-Num 0x%08x", EXTRACT_32BITS(p + 2));
        } else {
                printf(", unknown-option-%d", opt);
        }
        return len;
+
+trunc:
+       printf("[|bacp]");
+       return 0;
 }
 
 
@@ -1023,6 +1117,7 @@ ppp_print(register const u_char *p, u_int length)
         */
        if (length < 2)
                goto trunc;
+       TCHECK2(*p, 2);
        if (*p == PPP_ADDRESS && *(p + 1) == PPP_CONTROL) {
                p += 2;                 /* ACFC not used */
                length -= 2;
@@ -1031,12 +1126,14 @@ ppp_print(register const u_char *p, u_int length)
 
        if (length < 2)
                goto trunc;
+       TCHECK(*p);
        if (*p % 2) {
                proto = *p;             /* PFC is used */
                p++;
                length--;
                hdr_len++;
        } else {
+               TCHECK2(*p, 2);
                proto = EXTRACT_16BITS(p);
                p += 2;
                length -= 2;