mirrors/tcpdump
0
0
Fork 0
mirror of https://github.com/the-tcpdump-group/tcpdump.git synced 2024-11-23 18:14:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2016-7927/Do bounds checking on last_presentp before dereferencing it.

Browse Source 
Fixes a heap overflow found with American Fuzzy Lop by Hanno Böck.
This commit is contained in:
Guy Harris 2015-07-03 16:01:36 -07:00 committed by Francois-Xavier Le Bail
parent 6bc44295cf
commit da946bdc6c
4 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
print-802_11.c
View File

@ -3115,6 +3115,9 @@ ieee802_11_radio_print(netdissect_options *ndo,
len = EXTRACT_LE_16BITS(&hdr->it_len);
/*
* If we don't have the entire radiotap header, just give up.
*/
if (caplen < len) {
ND_PRINT((ndo, "%s", tstr));
return caplen;
@ -3122,13 +3125,13 @@ ieee802_11_radio_print(netdissect_options *ndo,
cpack_init(&cpacker, (const uint8_t *)hdr, len); /* align against header start */
cpack_advance(&cpacker, sizeof(*hdr)); /* includes the 1st bitmap */
for (last_presentp = &hdr->it_present;
IS_EXTENDED(last_presentp) &&
(const u_char*)(last_presentp + 1) <= p + len;
(const u_char*)(last_presentp + 1) <= p + len &&
IS_EXTENDED(last_presentp);
last_presentp++)
cpack_advance(&cpacker, sizeof(hdr->it_present)); /* more bitmaps */
/* are there more bitmap extensions than bytes in header? */
if (IS_EXTENDED(last_presentp)) {
if ((const u_char*)(last_presentp + 1) > p + len) {
ND_PRINT((ndo, "%s", tstr));
return caplen;
}

1
tests/TESTLIST
View File

@ -381,3 +381,4 @@ gre-heapoverflow-1 gre-heapoverflow-1.pcap gre-heapoverflow-1.out -t -v -n
gre-heapoverflow-2 gre-heapoverflow-2.pcap gre-heapoverflow-2.out -t -v -n
calm-fast-mac-lookup-heapoverflow calm-fast-mac-lookup-heapoverflow.pcap calm-fast-mac-lookup-heapoverflow.out -t -v -n
geonet-mac-lookup-heapoverflow geonet-mac-lookup-heapoverflow.pcap geonet-mac-lookup-heapoverflow.out -t -v -n
radiotap-heapoverflow radiotap-heapoverflow.pcap radiotap-heapoverflow.out -t -v -n

1
tests/radiotap-heapoverflow.out Normal file
View File

@ -0,0 +1 @@
[|802.11]

BIN
tests/radiotap-heapoverflow.pcap Normal file
View File

Binary file not shown.