Commit Graph

2 Commits

Author SHA1 Message Date
Francois-Xavier Le Bail
f253e11009 Add a sanity check on packet header length
The packet length must be <= MAXIMUM_SNAPLEN.

Currently, there is no D-Bus printer, thus no need for a bigger length.

Now a pachet is valid if:
capture length != 0,
packet length != 0,
capture length <= MAXIMUM_SNAPLEN,
packet length <= MAXIMUM_SNAPLEN,
packet length >= capture length.

Moreover:
Fix the packet header lengths of some fuzzed pcap files:
If the lengths are > MAXIMUM_SNAPLEN, set them to MAXIMUM_SNAPLEN.
Thus they will be always usable with this new sanity check.
2018-02-07 18:48:49 +01:00
Guy Harris
1dcd10acea CVE-2017-12897/ISO CLNS: Use ND_TTEST() for the bounds checks in isoclns_print().
This fixes a buffer over-read discovered by Kamil Frankowicz.

Don't pass the remaining caplen - that's too hard to get right, and we
were getting it wrong in at least one case; just use ND_TTEST().

Add a test using the capture file supplied by the reporter(s).
2017-09-13 12:25:44 +01:00