Repository : ssh://git@diktynna/batctl On branches: main,main
commit da75747d435ca8a32a74895655a1d5bff8b7709b Author: Sven Eckelmann sven@narfation.org Date: Sat Jan 27 13:49:02 2024 +0100
batctl: tcpdump: Add missing ICMPv6 Neighbor Advert length check
dump_ipv6() is doing a length check for the original ICMPv6 header length. But the neighbor advertisement (which is also handled by this function) is accessed without doing an additional length check. So it is possible that it tries to read outside of the received data.
Fixes: 35b37756f4a3 ("add IPv6 support to tcpdump parser") Cc: Marco Dalla Torre marco.dallato@gmail.com Signed-off-by: Sven Eckelmann sven@narfation.org
da75747d435ca8a32a74895655a1d5bff8b7709b tcpdump.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/tcpdump.c b/tcpdump.c index 3e8dece..51f0391 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -659,6 +659,8 @@ static void dump_ipv6(unsigned char *packet_buff, ssize_t buff_len, nd_nas_target, buff_len); break; case ND_NEIGHBOR_ADVERT: + LEN_CHECK((size_t)buff_len - (size_t)(sizeof(struct ip6_hdr)), + sizeof(*nd_advert), "ICMPv6 Neighbor Advertisement"); nd_advert = (struct nd_neighbor_advert *)icmphdr; inet_ntop(AF_INET6, &(nd_advert->nd_na_target), nd_nas_target, 40);