From: Francois-Xavier Le Bail <devel.fx.lebail@orange.fr>
Date: Mon, 11 Mar 2019 21:07:06 +0000 (+0100)
Subject: IPX: Add a length check
X-Git-Tag: tcpdump-4.99-bp~907
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/a24cccfd4abcda51db9f73f46d425c7c1e357a87?hp=2f6c71013128c8fd03faf71f5d3b8727cd984352

IPX: Add a length check

This fix an undefined behavior at runtime.

The error was:
print-ipx.c:93:43: runtime error: unsigned integer overflow: 29 - 30
cannot be represented in type 'unsigned int'

Add a test case.
---

diff --git a/print-ipx.c b/print-ipx.c
index 674dd457..c724e87f 100644
--- a/print-ipx.c
+++ b/print-ipx.c
@@ -90,6 +90,11 @@ ipx_print(netdissect_options *ndo, const u_char *p, u_int length)
 	ND_TCHECK_2(ipx->length);
 	length = EXTRACT_BE_U_2(ipx->length);
 
+	if (length < ipxSize) {
+		ND_PRINT("[length %u < %u]", length, ipxSize);
+		nd_print_invalid(ndo);
+		return;
+	}
 	ipx_decode(ndo, ipx, p + ipxSize, length - ipxSize);
 	return;
 trunc:
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 00fbe447..b666a0ef 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -93,6 +93,9 @@ e1000g		e1000g.pcap		e1000g.out
 # IPX/Netware packets
 ipx		ipx.pcap		ipx.out
 
+# IPX/Netware invalid
+ipx-invalid-length ipx-invalid-length.pcap ipx-invalid-length.out
+
 # IETF FORCES WG packets and printer
 forces01        forces1.pcap            forces1.out
 forces01vvv     forces1.pcap            forces1vvv.out  -v -v -v
diff --git a/tests/ipx-invalid-length.out b/tests/ipx-invalid-length.out
new file mode 100644
index 00000000..2904e8f9
--- /dev/null
+++ b/tests/ipx-invalid-length.out
@@ -0,0 +1 @@
+    1  16:41:40.226660 IPX 0a8808aa.00:00:00:00:00:01.0451 > 8dc23c00.18:00:3e:2b:68:56.402b: [length 29 < 30] (invalid)
diff --git a/tests/ipx-invalid-length.pcap b/tests/ipx-invalid-length.pcap
new file mode 100644
index 00000000..c65e47ae
Binary files /dev/null and b/tests/ipx-invalid-length.pcap differ