From: Francois-Xavier Le Bail Date: Sat, 27 Mar 2021 15:14:27 +0000 (+0100) Subject: ASCII/hex: Use nd_trunc_longjmp() in truncation cases X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/5ee4e508deb94d0a8a0268cd72fd66dcfc680eb5 ASCII/hex: Use nd_trunc_longjmp() in truncation cases In functions ascii_print(), hex_and_ascii_print_with_offset() and hex_print_with_offset(). Therefore indirectly for the functions hex_and_ascii_print(), hex_print() and ndo_default_print(). Even if hex_and_ascii_print(), hex_print() and ascii_print() are used in print.c after the setjmp() block with the calls: 1) hex_and_ascii_print(ndo, "\n\t", sp, h->caplen); 2) hex_and_ascii_print(ndo, "\n\t", sp + hdrlen, h->caplen - hdrlen); 3) hex_print(ndo, "\n\t", sp, h->caplen); 4) hex_print(ndo, "\n\t", sp + hdrlen, h->caplen - hdrlen); 5) ascii_print(ndo, sp, h->caplen); 6) ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen); sp and h->caplen are unmodified, ndo->ndo_snapend was restored. 1), 3) and 5) the length to print is caplen => no truncation can occur. 2), 4) and 6) the length to print is (caplen - hdrlen) after a shift of hdrlen => no truncation can occur. Moreover: Update the output of three tests accordingly. Remove an useless comment. Fix indentation. --- diff --git a/print-ascii.c b/print-ascii.c index e5b7a582..2f5fe854 100644 --- a/print-ascii.c +++ b/print-ascii.c @@ -64,11 +64,14 @@ ascii_print(netdissect_options *ndo, { u_int caplength; u_char s; + int truncated = FALSE; ndo->ndo_protocol = "ascii"; caplength = (ndo->ndo_snapend > cp) ? ND_BYTES_AVAILABLE_AFTER(cp) : 0; - if (length > caplength) + if (length > caplength) { length = caplength; + truncated = TRUE; + } ND_PRINT("\n"); while (length > 0) { s = GET_U_1(cp); @@ -94,6 +97,8 @@ ascii_print(netdissect_options *ndo, ND_PRINT("%c", s); } } + if (truncated) + nd_trunc_longjmp(ndo); } static void @@ -104,12 +109,15 @@ hex_and_ascii_print_with_offset(netdissect_options *ndo, const char *ident, u_int i; u_int s1, s2; u_int nshorts; + int truncated = FALSE; char hexstuff[HEXDUMP_SHORTS_PER_LINE*HEXDUMP_HEXSTUFF_PER_SHORT+1], *hsp; char asciistuff[ASCII_LINELENGTH+1], *asp; caplength = (ndo->ndo_snapend > cp) ? ND_BYTES_AVAILABLE_AFTER(cp) : 0; - if (length > caplength) + if (length > caplength) { length = caplength; + truncated = TRUE; + } nshorts = length / sizeof(u_short); i = 0; hsp = hexstuff; asp = asciistuff; @@ -149,6 +157,8 @@ hex_and_ascii_print_with_offset(netdissect_options *ndo, const char *ident, ident, oset, HEXDUMP_HEXSTUFF_PER_LINE, hexstuff, asciistuff); } + if (truncated) + nd_trunc_longjmp(ndo); } void @@ -169,10 +179,13 @@ hex_print_with_offset(netdissect_options *ndo, u_int caplength; u_int i, s; u_int nshorts; + int truncated = FALSE; caplength = (ndo->ndo_snapend > cp) ? ND_BYTES_AVAILABLE_AFTER(cp) : 0; - if (length > caplength) + if (length > caplength) { length = caplength; + truncated = TRUE; + } nshorts = length / sizeof(u_short); i = 0; while (nshorts != 0) { @@ -191,15 +204,15 @@ hex_print_with_offset(netdissect_options *ndo, ND_PRINT("%s0x%04x: ", ident, oset); ND_PRINT(" %02x", GET_U_1(cp)); } + if (truncated) + nd_trunc_longjmp(ndo); } -/* - * just for completeness - */ void -hex_print(netdissect_options *ndo,const char *ident, const u_char *cp, u_int length) +hex_print(netdissect_options *ndo, + const char *ident, const u_char *cp, u_int length) { - hex_print_with_offset(ndo, ident, cp, length, 0); + hex_print_with_offset(ndo, ident, cp, length, 0); } #ifdef MAIN diff --git a/tests/calm-fast-mac-lookup-heapoverflow.out b/tests/calm-fast-mac-lookup-heapoverflow.out index fd471d60..d8b64a5a 100644 --- a/tests/calm-fast-mac-lookup-heapoverflow.out +++ b/tests/calm-fast-mac-lookup-heapoverflow.out @@ -2,4 +2,4 @@ 2 05:27:12.808464432 CALM FAST; SrcNwref:48; DstNwref:48; 0x0000: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000 0x0010: 3030 3030 3030 3030 3030 3030 3030 3030 0000000000000000 - 0x0020: 3030 3030 3030 3030 3030 0000000000 + 0x0020: 3030 3030 3030 3030 3030 0000000000 [|calm_fast] diff --git a/tests/esis_snpa_asan.out b/tests/esis_snpa_asan.out index b4fd2009..a7d302f7 100644 --- a/tests/esis_snpa_asan.out +++ b/tests/esis_snpa_asan.out @@ -9,4 +9,4 @@ SNPA (length: 0): , bad opts/li 3 12:03:12.1048576 Q.922, hdr-len 2, DLCI 0, Flags [DE, FECN], NLPID unknown (0x22), length 72482: 0x0000: 0082 1000 5542 5343 70a1 0200 0400 0000 ....UBSCp....... - 0x0010: 007e .~ + 0x0010: 007e .~ [|fr] diff --git a/tests/q933-heapoverflow-2.out b/tests/q933-heapoverflow-2.out index 0dbd7a6f..0c616ea3 100644 --- a/tests/q933-heapoverflow-2.out +++ b/tests/q933-heapoverflow-2.out @@ -1,24 +1,24 @@ 1 22:26:23.800723 Q.922, invalid address 2 22:26:23.937975 UI 00! Q.922, hdr-len 4, DLCI 5769024, Flags [none], NLPID unknown (0x11), length 41: - 0x0000: 886b 68 .kh + 0x0000: 886b 68 .kh [|fr] 3 22:26:23.938313 Q.922, invalid address 4 22:26:23.939938 UI 00! Q.922, hdr-len 4, DLCI 5769024, Flags [none], NLPID unknown (0x14), length 160: - 0x0000: a530 b0 .0. + 0x0000: a530 b0 .0. [|fr] 5 22:26:23.940187 Q.922, invalid address 6 22:26:23.941938 UI 00! Q.922, hdr-len 4, DLCI 5801792, Flags [none], NLPID unknown (0x11), length 179: - 0x0000: 886b 68 .kh + 0x0000: 886b 68 .kh [|fr] 7 22:26:23.942187 Q.922, invalid address 8 22:26:23.944938 UI 00! Q.922, hdr-len 4, DLCI 5769024, Flags [none], NLPID unknown (0x14), length 30: - 0x0000: a530 b0 .0. + 0x0000: a530 b0 .0. [|fr] 9 22:26:23.945312 Q.922, invalid address 10 22:26:23.946188 UI 00! Q.922, hdr-len 4, DLCI 1856, Flags [none], NLPID unknown (0x11), length 85: - 0x0000: 886b 68 .kh + 0x0000: 886b 68 .kh [|fr] 11 22:26:23.946562 Q.922, invalid address 12 22:26:23.949189 Q.922, invalid address 13 22:26:23.949813 UI 00! Q.922, hdr-len 4, DLCI 526144, Flags [none], NLPID unknown (0x14), length 46: - 0x0000: a530 b0 .0. + 0x0000: a530 b0 .0. [|fr] 14 22:26:23.950187 Q.922, invalid address 15 22:26:24.634000 UI 2c! Pad! Q.922, hdr-len 2, DLCI 288, Flags [none], NLPID NULL (0x00), length 24: - 0x0000: 1188 6b68 ..kh + 0x0000: 1188 6b68 ..kh [|fr] 16 22:26:24.634098 Q.922, invalid address 17 22:26:24.634151 UI 2c! Pad! Q.933, CCITT, codeset 0 [|q.933]