From: Denis Ovsienko Date: Tue, 12 Sep 2017 10:30:50 +0000 (+0100) Subject: (for 4.9.3) Babel: Add a missing length check. X-Git-Tag: tcpdump-4.9.3~87 X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/651020754a171b1f279c2c444a5b1e725d4dd781 (for 4.9.3) Babel: Add a missing length check. In babel_print_v2() check that the Babel packet body length does not exceed the outer UDP packet payload. This helps to detect some invalid packets earlier but does not fix a known vulnerability. --- diff --git a/print-babel.c b/print-babel.c index 1a31f2a3..0bb2483a 100644 --- a/print-babel.c +++ b/print-babel.c @@ -352,6 +352,8 @@ babel_print_v2(netdissect_options *ndo, goto invalid; bodylen = EXTRACT_16BITS(cp + 2); ND_PRINT((ndo, " (%u)", bodylen)); + if (4U + bodylen > length) + goto invalid; /* Process the TLVs in the body */ i = 0; diff --git a/tests/babel_update_oobr.out b/tests/babel_update_oobr.out index 1d60fee0..03fb9dd6 100644 --- a/tests/babel_update_oobr.out +++ b/tests/babel_update_oobr.out @@ -63,4 +63,4 @@ IP 10.0.0.1.88 > 0.234.154.214.24074: v4 be KDC_REQUEST: .M-oM-^?M-^?@M-^?M-^@M IP 10.0.0.1.88 > 0.234.154.214.24074: v4 be KDC_REQUEST: ^O^O^O^O.^DM-2M-!^BM-W^CM-!^B@^D 0min ^P.^VM-^H [|kerberos] IP 10.0.0.1.88 > 0.234.154.214.24074: v4 be KDC_REQUEST: ^O^O^O^O^O7M-^@M-^?M-^@^D^O^O^O^O^O^P.M-^?M-^?^O^O^O@^VM-^H [|kerberos] IP 10.0.0.1.88 > 0.234.154.214.24074: v4 be KDC_REQUEST: ^O^O^O^O.^DM-^@M-^?M-^?M-^?^CM-!^B@^D 0min ^P.^VM-^H [|kerberos] -IP 208.21.42.58.6697 > 110.228.104.254.30952: babel 2 (2056) update/truncated update/truncated update/truncated [|babel] +IP 208.21.42.58.6697 > 110.228.104.254.30952: babel 2 (2056) (invalid)