dump_ipv6() is doing a length check for the original ICMPv6 header length. But the neighbor advertisement (which is also handled by this function) is accessed without doing an additional length check. So it is possible that it tries to read outside of the received data.
Fixes: 35b37756f4a3 ("add IPv6 support to tcpdump parser") Cc: Marco Dalla Torre marco.dallato@gmail.com Signed-off-by: Sven Eckelmann sven@narfation.org --- tcpdump.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/tcpdump.c b/tcpdump.c index 3fdd7c3..2ae3909 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -659,6 +659,8 @@ static void dump_ipv6(unsigned char *packet_buff, ssize_t buff_len, nd_nas_target, buff_len); break; case ND_NEIGHBOR_ADVERT: + LEN_CHECK((size_t)buff_len - (size_t)(sizeof(struct ip6_hdr)), + sizeof(*nd_advert), "ICMPv6 Neighbor Advertisement"); nd_advert = (struct nd_neighbor_advert *)icmphdr; inet_ntop(AF_INET6, &(nd_advert->nd_na_target), nd_nas_target, 40);