Fix OOB read while parsing QUIC SH packets.

diff --git a/print-quic.c b/print-quic.c
index be1a5450ea62425528b2813af3c3dd1701975fb2..eb8120b22fad6003ebd15253ec6cb1f2827001d4 100644 (file)
--- a/print-quic.c
+++ b/print-quic.c
@@ -226,7 +226,8 @@ quic_print_packet(netdissect_options *ndo, const u_char *bp, const u_char *end)
                        }
                        if (packet_type == QUIC_LH_TYPE_RETRY) {
                                ND_PRINT(", token ");
-                               if (end > bp && end - bp > 16) {
+                               if (end > bp && end - bp > 16 &&
+                                   ND_TTEST_LEN(bp, end - bp - 16)) {
                                        token_length = end - bp - 16;
                                        token = nd_malloc(ndo, (size_t)token_length);
                                        GET_CPY_BYTES(token, bp, (size_t)token_length);
@@ -252,7 +253,8 @@ quic_print_packet(netdissect_options *ndo, const u_char *bp, const u_char *end)
        } else {
                /* Short Header */
                ND_PRINT(", protected");
-               if (ND_TTEST_LEN(bp, 16)) {
+               if (end > bp && end - bp > 16 &&
+                   ND_TTEST_LEN(bp, end - bp)) {
                        struct quic_cid_array *cid_array =
                                lookup_quic_cid(bp, end - bp);
                        if (cid_array != NULL) {

diff --git a/tests/quic_handshake_truncated.out b/tests/quic_handshake_truncated.out
index 909b61910bf522c895eff90a6c83fa6a26a9a72d..00882b321e996307b7ff3fe13c21bbcd643ae475 100644 (file)
--- a/tests/quic_handshake_truncated.out
+++ b/tests/quic_handshake_truncated.out
@@ -7,7 +7,7 @@
     7  19:57:02.485464 IP6 (class 0x02, flowlabel 0x70e00, hlim 64, next-header UDP (17) payload length: 81) ::1.65165 > ::1.443: [bad udp cksum 0x0064 -> 0x9855!] quic, handshake, dcid beb256567ee5698c, length 56
     8  19:57:02.485711 IP6 (class 0x02, flowlabel 0x50700, hlim 64, next-header UDP (17) payload length: 50) ::1.443 > ::1.65165: [bad udp cksum 0x0045 -> 0xca20!] quic, handshake, scid beb256567ee5698c, length 25
     9  19:57:02.485809 IP6 (class 0x02, flowlabel 0x50700, hlim 64, next-header UDP (17) payload length: 29) ::1.443 > ::1.65165: [bad udp cksum 0x0030 -> 0x4f93!] quic, protected
-   10  19:57:02.486075 IP6 (class 0x02, flowlabel 0x50700, hlim 64, next-header UDP (17) payload length: 250) ::1.443 > ::1.65165: quic, protected
+   10  19:57:02.486075 IP6 (class 0x02, flowlabel 0x50700, hlim 64, next-header UDP (17) payload length: 250) ::1.443 > ::1.65165: quic, protected [|quic]
    11  19:57:02.486726 IP6 (class 0x02, flowlabel 0x70e00, hlim 64, next-header UDP (17) payload length: 39) ::1.65165 > ::1.443: [bad udp cksum 0x003a -> 0x38d3!] quic, protected, dcid beb256567ee5698c
    12  19:57:02.487067 IP6 (class 0x02, flowlabel 0x70e00, hlim 64, next-header UDP (17) payload length: 37) ::1.65165 > ::1.443: [bad udp cksum 0x0038 -> 0x3993!] quic, protected, dcid beb256567ee5698c
    13  19:57:02.487144 IP6 (class 0x02, flowlabel 0x70e00, hlim 64, next-header UDP (17) payload length: 37) ::1.65165 > ::1.443: [bad udp cksum 0x0038 -> 0x7ae0!] quic, protected, dcid beb256567ee5698c