mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-23 10:04:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2017-13000/IEEE 802.15.4: Fix bug introduced by previous fix.

Browse Source 
We've already advanced the pointer past the PAN ID, if present; it now
points to the address, so don't add 2 to it.

This fixes a buffer over-read discovered by Forcepoint's security
researchers Otto Airamo & Antti Levomäki.

Add a test using the capture file supplied by the reporter(s).
This commit is contained in:
Guy Harris 2017-02-21 13:40:19 -08:00 committed by Denis Ovsienko
parent 9be4e0b593
commit a7e5f58f40
4 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
print-802_15_4.c
View File

@ -141,7 +141,7 @@ ieee802_15_4_if_print(netdissect_options *ndo,
return hdrlen;
}
if (ndo->ndo_vflag)
ND_PRINT((ndo,"%04x:%s ", panid, le64addr_string(ndo, p + 2)));
ND_PRINT((ndo,"%04x:%s ", panid, le64addr_string(ndo, p)));
p += 8;
caplen -= 8;
hdrlen += 8;

1
tests/802_15_4-data.out Normal file
View File

@ -0,0 +1 @@
IEEE 802.15.4 Data packet seq 01 ab4d:10:05:00:81:00:01:00:01 < [|802.15.4]

BIN
tests/802_15_4-data.pcap Normal file
View File

Binary file not shown.

1
tests/TESTLIST
View File

@ -488,6 +488,7 @@ pimv2-oobr-3 pimv2-oobr-3.pcap pimv2-oobr-3.out -vvv -e
pimv2-oobr-4 pimv2-oobr-4.pcap pimv2-oobr-4.out -vvv -e
802_15_4-oobr-1 802_15_4-oobr-1.pcap 802_15_4-oobr-1.out -vvv -e
802_15_4-oobr-2 802_15_4-oobr-2.pcap 802_15_4-oobr-2.out -vvv -e
802_15_4-data 802_15_4-data.pcap 802_15_4-data.out -vvv -e
# RTP tests
# fuzzed pcap