Repository : ssh://git@diktynna/batctl On branches: main,main

commit da75747d435ca8a32a74895655a1d5bff8b7709b Author: Sven Eckelmann sven@narfation.org Date: Sat Jan 27 13:49:02 2024 +0100

batctl: tcpdump: Add missing ICMPv6 Neighbor Advert length check

dump_ipv6() is doing a length check for the original ICMPv6 header length. But the neighbor advertisement (which is also handled by this function) is accessed without doing an additional length check. So it is possible that it tries to read outside of the received data.

Fixes: 35b37756f4a3 ("add IPv6 support to tcpdump parser") Cc: Marco Dalla Torre marco.dallato@gmail.com Signed-off-by: Sven Eckelmann sven@narfation.org

da75747d435ca8a32a74895655a1d5bff8b7709b tcpdump.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/tcpdump.c b/tcpdump.c index 3e8dece..51f0391 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -659,6 +659,8 @@ static void dump_ipv6(unsigned char *packet_buff, ssize_t buff_len, nd_nas_target, buff_len); break; case ND_NEIGHBOR_ADVERT: + LEN_CHECK((size_t)buff_len - (size_t)(sizeof(struct ip6_hdr)), + sizeof(*nd_advert), "ICMPv6 Neighbor Advertisement"); nd_advert = (struct nd_neighbor_advert *)icmphdr; inet_ntop(AF_INET6, &(nd_advert->nd_na_target), nd_nas_target, 40);