b.a.t.m.a.n.lists.open-mesh.org archive mirror
 help / color / mirror / Atom feed
From: Sven Eckelmann <sven@narfation.org>
To: b.a.t.m.a.n@lists.open-mesh.org
Cc: Sven Eckelmann <sven@narfation.org>
Subject: [PATCH 1/6] batctl: tcpdump: Fix missing sanity check for batman-adv header
Date: Sat, 27 Jan 2024 13:48:59 +0100	[thread overview]
Message-ID: <20240127-tcpdump_fuzzing-v1-1-fbc1e1d3fec1@narfation.org> (raw)
In-Reply-To: <20240127-tcpdump_fuzzing-v1-0-fbc1e1d3fec1@narfation.org>

parse_eth_hdr() is assuming that every ETH_P_BATMAN ethernet packet has a
valid, minimal batman-adv header (packet_type, version, ttl) attached. But
it doesn't actually check if the received buffer has enough bytes to access
the two bytes packet_type + version. So it is possible that it tries to
read outside of the received data.

Fixes: 3bdfc388e74b ("implement simple tcpdump, first only batman packets")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
---
 tcpdump.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tcpdump.c b/tcpdump.c
index d340af9..d15c32e 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -1167,6 +1167,9 @@ static void parse_eth_hdr(unsigned char *packet_buff, ssize_t buff_len, int read
 			dump_vlan(packet_buff, buff_len, read_opt, time_printed);
 		break;
 	case ETH_P_BATMAN:
+		/* check for batman-adv packet_type + version */
+		LEN_CHECK(buff_len, sizeof(*eth_hdr) + 2, "BAT HEADER")
+
 		batman_ogm_packet = (struct batadv_ogm_packet *)(packet_buff + ETH_HLEN);
 
 		if ((read_opt & COMPAT_FILTER) &&

-- 
2.39.2


  reply	other threads:[~2024-01-27 12:50 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-01-27 12:48 [PATCH 0/6] batctl: tcpdump: Fix problems detected during fuzzing Sven Eckelmann
2024-01-27 12:48 ` Sven Eckelmann [this message]
2024-01-27 12:49 ` [PATCH 2/6] batctl: tcpdump: Add missing throughput header length check Sven Eckelmann
2024-01-27 12:49 ` [PATCH 3/6] batctl: tcpdump: Fix IPv4 " Sven Eckelmann
2024-01-27 12:49 ` [PATCH 4/6] batctl: tcpdump: Add missing ICMPv6 Neighbor Advert " Sven Eckelmann
2024-01-27 12:49 ` [PATCH 5/6] batctl: tcpdump: Add missing ICMPv6 Neighbor Solicit " Sven Eckelmann
2024-01-27 12:49 ` [PATCH 6/6] batctl: tcpdump: Fix ICMPv4 inner IPv4 header " Sven Eckelmann
2024-01-27 12:51 ` [PATCH 0/6] batctl: tcpdump: Fix problems detected during fuzzing Sven Eckelmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240127-tcpdump_fuzzing-v1-1-fbc1e1d3fec1@narfation.org \
    --to=sven@narfation.org \
    --cc=b.a.t.m.a.n@lists.open-mesh.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).