tcpdump/tests/tftp-heapoverflow.out
Guy Harris 7bf069c251 CVE-2016-7983,7984/Don't use strchr() to scan packet data.
It can't be told to stop at the end of the packet data.  Add a
fn_printztn() that prints null-terminated strings, with a length check,
and which returns the number of bytes processed, or 0 if we ran out of
data.  That means it does the scanning we need, but safely.

Use it in the TFTP and BOOTP printers.

Fixes a heap overflow found with American Fuzzy Lop by Hanno Böck.
2017-01-18 09:16:37 +01:00

3 lines
174 B
Plaintext

IP (tos 0x30, ttl 48, id 12336, offset 0, flags [DF], proto UDP (17), length 12336, bad cksum 3030 (->299d)!)
48.48.48.48.69 > 48.48.48.48.12336: 12308 RRQ "00" [|tftp]