diff options
| author | Guy Harris <guy@alum.mit.edu> | 2017-03-21 22:02:41 -0700 |
|---|---|---|
| committer | Denis Ovsienko <denis@ovsienko.info> | 2017-09-13 12:25:44 +0100 |
| commit | c5dd7bef5e54da5996dc4713284aa6266ae75b75 (patch) | |
| tree | f62e131da907d24ba3f4ad6a8bb0cd62e20a0802 | |
| parent | 4601c685e7fd19c3724d5e499c69b8d3ec49933e (diff) | |
| download | tcpdump-c5dd7bef5e54da5996dc4713284aa6266ae75b75.tar.gz | |
CVE-2017-13020/VTP: Add some missing bounds checks.
This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.
Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.
| -rw-r--r-- | print-vtp.c | 2 | ||||
| -rw-r--r-- | tests/TESTLIST | 1 | ||||
| -rw-r--r-- | tests/vtp_asan.out | 6 | ||||
| -rw-r--r-- | tests/vtp_asan.pcap | bin | 0 -> 154 bytes |
4 files changed, 9 insertions, 0 deletions
diff --git a/print-vtp.c b/print-vtp.c index 285beb96..18c1356e 100644 --- a/print-vtp.c +++ b/print-vtp.c @@ -223,6 +223,7 @@ vtp_print (netdissect_options *ndo, * */ + ND_TCHECK_32BITS(tptr); ND_PRINT((ndo, ", Config Rev %x", EXTRACT_32BITS(tptr))); /* @@ -243,6 +244,7 @@ vtp_print (netdissect_options *ndo, tptr += 4; while (tptr < (pptr+length)) { + ND_TCHECK_8BITS(tptr); len = *tptr; if (len == 0) break; diff --git a/tests/TESTLIST b/tests/TESTLIST index 94237232..6f5d3314 100644 --- a/tests/TESTLIST +++ b/tests/TESTLIST @@ -521,6 +521,7 @@ esis_snpa_asan-5 esis_snpa_asan-5.pcap esis_snpa_asan-5.out -v dhcp6_reconf_asan dhcp6_reconf_asan.pcap dhcp6_reconf_asan.out -v pgm_opts_asan pgm_opts_asan.pcap pgm_opts_asan.out -v pgm_opts_asan_2 pgm_opts_asan_2.pcap pgm_opts_asan_2.out -v +vtp_asan vtp_asan.pcap vtp_asan.out -v # RTP tests # fuzzed pcap diff --git a/tests/vtp_asan.out b/tests/vtp_asan.out new file mode 100644 index 00000000..17b682bf --- /dev/null +++ b/tests/vtp_asan.out @@ -0,0 +1,6 @@ +FRF.16 Frag, seq 193, Flags [Begin, End], UI 08! VTPv69, Message Subset advertisement (0x02), length 2126400013 + Domain name: , Seq number: 0[|vtp] +[|mfr] +[|mfr] +[|mfr] +[|mfr] diff --git a/tests/vtp_asan.pcap b/tests/vtp_asan.pcap Binary files differnew file mode 100644 index 00000000..515828a0 --- /dev/null +++ b/tests/vtp_asan.pcap |