CVE-2017-13049/Rx: add a missing bounds check for Ubik

One of the case blocks in ubik_print() didn't check bounds before
fetching 32 bits of packet data and could overread past the captured
packet data by that amount.

This fixes a buffer over-read discovered by Henri Salo from Nixu
Corporation.

Add a test using the capture file supplied by the reporter(s).

diff --git a/print-rx.c b/print-rx.c
index ea3a5e67a2f4bc117cf8f3dc6bf3a71d852ebb9e..30528e991684bd97c2237f5e1896498016403f24 100644 (file)
--- a/print-rx.c
+++ b/print-rx.c
@@ -2577,6 +2577,7 @@ ubik_print(netdissect_options *ndo,
                        INTOUT();
                        ND_PRINT((ndo, " length"));
                        INTOUT();
+                       ND_TCHECK_32BITS(bp);
                        temp = EXTRACT_32BITS(bp);
                        bp += sizeof(int32_t);
                        tok2str(ubik_lock_types, "type %d", temp);

diff --git a/tests/TESTLIST b/tests/TESTLIST
index 80c5c1478e738226c291a8355e48abf3a978163c..af22ccce1ca62c375886476f442f881db41fc8de 100644 (file)
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -570,6 +570,9 @@ mlppp-oobr          mlppp-oobr.pcap                 mlppp-oobr.out
 mptcp-dss-oobr         mptcp-dss-oobr.pcap             mptcp-dss-oobr.out      -v
 icmp6_nodeinfo_oobr    icmp6_nodeinfo_oobr.pcap        icmp6_nodeinfo_oobr.out
 
+# bad packets from Henri Salo
+rx_ubik-oobr           rx_ubik-oobr.pcap               rx_ubik-oobr.out -c1
+
 # RTP tests
 # fuzzed pcap
 rtp-seg-fault-1  rtp-seg-fault-1.pcap  rtp-seg-fault-1.out  -v -T rtp

diff --git a/tests/rx_ubik-oobr.out b/tests/rx_ubik-oobr.out
new file mode 100644 (file)
index 0000000..f192432
--- /dev/null
+++ b/tests/rx_ubik-oobr.out
@@ -0,0 +1 @@
+IP truncated-ip - 2598 bytes missing! 222.241.104.198.3503 > 131.63.241.146.7002:  rx data pt ubik call disk-lock tid 50266112.32382 file 2122216448 pos 545160708 length 1087685554 [|ubik] (2632)

diff --git a/tests/rx_ubik-oobr.pcap b/tests/rx_ubik-oobr.pcap
new file mode 100644 (file)
index 0000000..69caac9
Binary files /dev/null and b/tests/rx_ubik-oobr.pcap differ