From: guy <guy>
Date: Fri, 23 Feb 2001 08:55:21 +0000 (+0000)
Subject: Audit DNS printer for buffer overflows.  Use TTEST2() in tests, and make
X-Git-Tag: tcpdump-3.7.1~256
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/46de5c986cf345056c6685618db1cf1f0198f596

Audit DNS printer for buffer overflows.  Use TTEST2() in tests, and make
some additional tests (some of which might, in theory, be unnecessary,
but...).  Check for null pointers *before* checking whether there's
enough data at the pointer in question.
---

diff --git a/print-domain.c b/print-domain.c
index efde6a4f..c0a4be5b 100644
--- a/print-domain.c
+++ b/print-domain.c
@@ -21,7 +21,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-domain.c,v 1.74 2001-02-21 08:52:30 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-domain.c,v 1.75 2001-02-23 08:55:21 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -67,24 +67,26 @@ ns_nskip(register const u_char *cp, register const u_char *bp)
 {
 	register u_char i;
 
+	if (!TTEST2(*cp, 1))
+		return (NULL);
 	if (((i = *cp++) & INDIR_MASK) == INDIR_MASK)
 		return (cp + 1);
-	if (cp >= snapend)
-		return(NULL);
-	while (i && cp < snapend) {
+	while (i) {
 		if ((i & INDIR_MASK) == EDNS0_MASK) {
 			int bitlen, bytelen;
 
 			if ((i & ~INDIR_MASK) != EDNS0_ELT_BITLABEL)
 				return(NULL); /* unknown ELT */
+			if (!TTEST2(*cp, 1))
+				return (NULL);
 			if ((bitlen = *cp++) == 0)
 				bitlen = 256;
 			bytelen = (bitlen + 7) / 8;
 			cp += bytelen;
 		} else
 			cp += i;
-		if (cp >= snapend)
-			return(NULL);
+		if (!TTEST2(*cp, 1))
+			return (NULL);
 		i = *cp++;
 	}
 	return (cp);
@@ -99,7 +101,7 @@ blabel_print(const u_char *cp)
 	const u_char *bitp, *lim;
 	char tc;
 
-	if (cp >= snapend)
+	if (!TTEST2(*cp, 1))
 		return(NULL);
 	if ((bitlen = *cp) == 0)
 		bitlen = 256;
@@ -132,7 +134,7 @@ labellen(const u_char *cp)
 {
 	register u_int i;
 
-	if (cp >= snapend)
+	if (!TTEST2(*cp, 1))
 		return(-1);
 	i = *cp;
 	if ((i & INDIR_MASK) == EDNS0_MASK) {
@@ -140,7 +142,7 @@ labellen(const u_char *cp)
 
 		if ((elt = (i & ~INDIR_MASK)) != EDNS0_ELT_BITLABEL)
 			return(-1);
-		if (cp + 1 >= snapend)
+		if (!TTEST2(*(cp + 1), 1))
 			return(-1);
 		if ((bitlen = *(cp + 1)) == 0)
 			bitlen = 256;
@@ -161,7 +163,7 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
 
 	if ((l = labellen(cp)) < 0)
 		return(NULL);
-	if (cp >= snapend)
+	if (!TTEST2(*cp, 1))
 		return(NULL);
 	chars_processed = 1;
 	if (((i = *cp++) & INDIR_MASK) != INDIR_MASK) {
@@ -176,11 +178,13 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
 					rp = cp + 1;
 					compress = 1;
 				}
-				cp = bp + (((i << 8) | *cp) & 0x3fff);
-				if (cp >= snapend)
+				if (!TTEST2(*cp, 1))
 					return(NULL);
+				cp = bp + (((i << 8) | *cp) & 0x3fff);
 				if ((l = labellen(cp)) < 0)
 					return(NULL);
+				if (!TTEST2(*cp, 1))
+					return(NULL);
 				i = *cp++;
 				chars_processed++;
 
@@ -200,7 +204,8 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
 				elt = (i & ~INDIR_MASK);
 				switch(elt) {
 				case EDNS0_ELT_BITLABEL:
-					blabel_print(cp);
+					if (blabel_print(cp) == NULL)
+						return (NULL);
 					break;
 				default:
 					/* unknown ELT */
@@ -209,13 +214,15 @@ ns_nprint(register const u_char *cp, register const u_char *bp)
 				}
 			} else {
 				if (fn_printn(cp, l, snapend))
-					break;
+					return(NULL);
 			}
 
 			cp += l;
 			chars_processed += l;
 			putchar('.');
-			if (cp >= snapend || (l = labellen(cp)) < 0)
+			if ((l = labellen(cp)) < 0)
+				return(NULL);
+			if (!TTEST2(*cp, 1))
 				return(NULL);
 			i = *cp++;
 			chars_processed++;
@@ -233,10 +240,11 @@ ns_cprint(register const u_char *cp, register const u_char *bp)
 {
 	register u_int i;
 
-	if (cp >= snapend)
-		return NULL;
+	if (!TTEST2(*cp, 1))
+		return (NULL);
 	i = *cp++;
-	(void)fn_printn(cp, i, snapend);
+	if (fn_printn(cp, i, snapend))
+		return (NULL);
 	return (cp + i);
 }
 
@@ -311,7 +319,7 @@ ns_qprint(register const u_char *cp, register const u_char *bp)
 
 	cp = ns_nskip(cp, bp);
 
-	if (cp + 4 > snapend || cp == NULL)
+	if (cp == NULL || !TTEST2(*cp, 4))
 		return(NULL);
 
 	/* print the qtype and qclass (if it's not IN) */
@@ -343,7 +351,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 	} else
 		cp = ns_nskip(cp, bp);
 
-	if (cp + 10 > snapend || cp == NULL)
+	if (cp == NULL || !TTEST2(*cp, 10))
 		return (snapend);
 
 	/* print the type/qtype and class (if it's not IN) */
@@ -368,7 +376,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 
 	switch (typ) {
 	case T_A:
-		if (cp + sizeof(struct in_addr) > snapend)
+		if (!TTEST2(*cp, sizeof(struct in_addr)))
 			return(NULL);
 		printf(" %s", ipaddr_string(cp));
 		break;
@@ -393,7 +401,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 		putchar(' ');
 		if ((cp = ns_nprint(cp, bp)) == NULL)
 			return(NULL);
-		if (cp + 5 * 4 > snapend)
+		if (!TTEST2(*cp, 5 * 4))
 			return(NULL);
 		printf(" %u", EXTRACT_32BITS(cp));
 		cp += 4;
@@ -408,7 +416,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 		break;
 	case T_MX:
 		putchar(' ');
-		if (cp + 2 > snapend)
+		if (!TTEST2(*cp, 2))
 			return(NULL);
 		if (ns_nprint(cp + 2, bp) == NULL)
 			return(NULL);
@@ -422,7 +430,7 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 
 #ifdef INET6
 	case T_AAAA:
-		if (cp + sizeof(struct in6_addr) > snapend)
+		if (!TTEST2(*cp, sizeof(struct in6_addr)))
 			return(NULL);
 		printf(" %s", ip6addr_string(cp));
 		break;
@@ -432,12 +440,16 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 		struct in6_addr a;
 		int pbit, pbyte;
 
+		if (!TTEST2(*cp, 1))
+			return(NULL);
 		pbit = *cp;
 		pbyte = (pbit & ~7) / 8;
 		if (pbit > 128) {
 			printf(" %u(bad plen)", pbit);
 			break;
 		} else if (pbit < 128) {
+			if (!TTEST2(*(cp + 1), sizeof(a) - pbyte))
+				return(NULL);
 			memset(&a, 0, sizeof(a));
 			memcpy(&a.s6_addr[pbyte], cp + 1, sizeof(a) - pbyte);
 			printf(" %u %s", pbit, ip6addr_string(&a));
@@ -456,9 +468,10 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 		break;
 
 	case T_UNSPECA:		/* One long string */
-		if (cp + len > snapend)
+		if (!TTEST2(*cp, len))
+			return(NULL);
+		if (fn_printn(cp, len, snapend))
 			return(NULL);
-		fn_printn(cp, len, snapend);
 		break;
 
 	case T_TSIG:
@@ -471,14 +484,24 @@ ns_rprint(register const u_char *cp, register const u_char *bp)
 		if ((cp = ns_nprint(cp, bp)) == NULL)
 			return(NULL);
 		cp += 6;
+		if (!TTEST2(*cp, 2))
+			return(NULL);
 		printf(" fudge=%u", EXTRACT_16BITS(cp));
 		cp += 2;
+		if (!TTEST2(*cp, 2))
+			return(NULL);
 		printf(" maclen=%u", EXTRACT_16BITS(cp));
 		cp += 2 + EXTRACT_16BITS(cp);
+		if (!TTEST2(*cp, 2))
+			return(NULL);
 		printf(" origid=%u", EXTRACT_16BITS(cp));
 		cp += 2;
+		if (!TTEST2(*cp, 2))
+			return(NULL);
 		printf(" error=%u", EXTRACT_16BITS(cp));
 		cp += 2;
+		if (!TTEST2(*cp, 2))
+			return(NULL);
 		printf(" otherlen=%u", EXTRACT_16BITS(cp));
 		cp += 2;
 	    }