mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-24 10:33:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2017-13020/VTP: Add some missing bounds checks.

Browse Source 
This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.
This commit is contained in:
Guy Harris 2017-03-21 22:02:41 -07:00 committed by Denis Ovsienko
parent 4601c685e7
commit c5dd7bef5e
4 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
print-vtp.c
View File

@ -223,6 +223,7 @@ vtp_print (netdissect_options *ndo,
*
*/
ND_TCHECK_32BITS(tptr);
ND_PRINT((ndo, ", Config Rev %x", EXTRACT_32BITS(tptr)));
/*
@ -243,6 +244,7 @@ vtp_print (netdissect_options *ndo,
tptr += 4;
while (tptr < (pptr+length)) {
ND_TCHECK_8BITS(tptr);
len = *tptr;
if (len == 0)
break;

1
tests/TESTLIST
View File

@ -521,6 +521,7 @@ esis_snpa_asan-5 esis_snpa_asan-5.pcap esis_snpa_asan-5.out -v
dhcp6_reconf_asan dhcp6_reconf_asan.pcap dhcp6_reconf_asan.out -v
pgm_opts_asan pgm_opts_asan.pcap pgm_opts_asan.out -v
pgm_opts_asan_2 pgm_opts_asan_2.pcap pgm_opts_asan_2.out -v
vtp_asan vtp_asan.pcap vtp_asan.out -v
# RTP tests
# fuzzed pcap

6
tests/vtp_asan.out Normal file
View File

@ -0,0 +1,6 @@
FRF.16 Frag, seq 193, Flags [Begin, End], UI 08! VTPv69, Message Subset advertisement (0x02), length 2126400013
Domain name: , Seq number: 0[|vtp]
[|mfr]
[|mfr]
[|mfr]
[|mfr]

BIN
tests/vtp_asan.pcap Normal file
View File

Binary file not shown.