From: Michael Richardson <mcr@sandelman.ca>
Date: Mon, 16 Feb 2015 02:22:11 +0000 (-0500)
Subject: test case for cve2015-0261 -- corrupted IPv6 mobility header
X-Git-Tag: tcpdump-4.7.2~1^2~7
X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/beec87b5164e97349d50cb93c02dc7f05dfa3a03

test case for cve2015-0261 -- corrupted IPv6 mobility header
---

diff --git a/print-mobility.c b/print-mobility.c
index 83447cff..b6fa61e9 100644
--- a/print-mobility.c
+++ b/print-mobility.c
@@ -69,6 +69,18 @@ struct ip6_mobility {
 #define IP6M_BINDING_UPDATE	5	/* Binding Update */
 #define IP6M_BINDING_ACK	6	/* Binding Acknowledgement */
 #define IP6M_BINDING_ERROR	7	/* Binding Error */
+#define IP6M_MAX		7
+
+static const unsigned ip6m_hdrlen[IP6M_MAX + 1] = {
+	IP6M_MINLEN,      /* IP6M_BINDING_REQUEST  */
+	IP6M_MINLEN + 8,  /* IP6M_HOME_TEST_INIT   */
+	IP6M_MINLEN + 8,  /* IP6M_CAREOF_TEST_INIT */
+	IP6M_MINLEN + 16, /* IP6M_HOME_TEST        */
+	IP6M_MINLEN + 16, /* IP6M_CAREOF_TEST      */
+	IP6M_MINLEN + 4,  /* IP6M_BINDING_UPDATE   */
+	IP6M_MINLEN + 4,  /* IP6M_BINDING_ACK      */
+	IP6M_MINLEN + 16, /* IP6M_BINDING_ERROR    */
+};
 
 /* XXX: unused */
 #define IP6MOPT_BU_MINLEN	10
@@ -95,16 +107,20 @@ mobility_opt_print(netdissect_options *ndo,
 	unsigned i, optlen;
 
 	for (i = 0; i < len; i += optlen) {
+		ND_TCHECK(bp[i]);
 		if (bp[i] == IP6MOPT_PAD1)
 			optlen = 1;
 		else {
-			if (i + 1 < len)
+			if (i + 1 < len) {
+				ND_TCHECK(bp[i + 1]);
 				optlen = bp[i + 1] + 2;
+			}
 			else
 				goto trunc;
 		}
 		if (i + optlen > len)
 			goto trunc;
+		ND_TCHECK(bp[i + optlen]);
 
 		switch (bp[i]) {
 		case IP6MOPT_PAD1:
@@ -203,6 +219,10 @@ mobility_print(netdissect_options *ndo,
 
 	ND_TCHECK(mh->ip6m_type);
 	type = mh->ip6m_type;
+	if (type <= IP6M_MAX && mhlen < ip6m_hdrlen[type]) {
+		ND_PRINT((ndo, "(header length %u is too small for type %u)", mhlen, type));
+		goto trunc;
+	}
 	switch (type) {
 	case IP6M_BINDING_REQUEST:
 		ND_PRINT((ndo, "mobility: BRR"));
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 08dc9e3d..788d532d 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -277,4 +277,7 @@ kday5           kday5.pcap              kday5.out       -t -v
 kday6           kday6.pcap              kday6.out       -t -v
 kday7           kday7.pcap              kday7.out       -t -v
 kday8           kday8.pcap              kday8.out       -t -v
-                                            
\ No newline at end of file
+
+# bad packets from reversex86.
+cve2015-0261_01    cve2015-0261-ipv6.pcap       cve2015-0261-ipv6.out -t -v
+cve2015-0261_02    cve2015-0261-crash.pcap      cve2015-0261-crash.out -t -v
diff --git a/tests/cve2015-0261-crash.out b/tests/cve2015-0261-crash.out
new file mode 100644
index 00000000..1946280c
--- /dev/null
+++ b/tests/cve2015-0261-crash.out
@@ -0,0 +1 @@
+IP6 (class 0x03, flowlabel 0x03030, hlim 48, next-header Options (0) payload length: 12336) 3030:3030:3030:3030:3030:3030:3030:3030 > 130:3030:3030:3030:3030:3030:3030:3030: HBH [trunc] (header length 8 is too small for type 1)[|MOBILITY]
diff --git a/tests/cve2015-0261-crash.pcap b/tests/cve2015-0261-crash.pcap
new file mode 100644
index 00000000..c876c1ff
Binary files /dev/null and b/tests/cve2015-0261-crash.pcap differ
diff --git a/tests/cve2015-0261-ipv6.out b/tests/cve2015-0261-ipv6.out
new file mode 100644
index 00000000..5edcddac
--- /dev/null
+++ b/tests/cve2015-0261-ipv6.out
@@ -0,0 +1 @@
+EXIT CODE 00000100
diff --git a/tests/cve2015-0261-ipv6.pcap b/tests/cve2015-0261-ipv6.pcap
new file mode 100644
index 00000000..a8a32ba9
Binary files /dev/null and b/tests/cve2015-0261-ipv6.pcap differ