mirror of
https://github.com/the-tcpdump-group/tcpdump.git
synced 2024-11-24 02:23:27 +08:00
289c672020
Fixup the part of rsvp_obj_print() that decodes the GENERALIZED_UNI object from RFC 3476 Section 3.1 to check the sub-objects inside that object more thoroughly. This fixes a buffer over-read discovered by Bhargava Shastry, SecT/TU Berlin. Add a test using the capture file supplied by the reporter(s).
6 lines
421 B
Plaintext
6 lines
421 B
Plaintext
IP (tos 0x2,ECT(0), ttl 248, id 0, offset 0, flags [none], proto RSVP (46), length 54312, bad cksum 3743 (->3051)!)
|
|
54.35.78.33 > 58.16.0.0:
|
|
RSVPv1 Hello Message (20), Flags: [Refresh reduction capable], length: 65527, ttl: 15, checksum: 0x0902
|
|
Generalized UNI Object (229) Flags: [ignore and forward if unknown], Class-Type: 1 (1), length: 12
|
|
Subobject Type: Unknown (0), AF: HDLC (4), length: 2 (invalid)
|