Repository : ssh://git@diktynna/batctl On branches: main,main

commit 7ae3bdb59a7501197e12d3a7ab0d9924341e9ca8 Author: Sven Eckelmann sven@narfation.org Date: Sat Jan 27 13:48:59 2024 +0100

batctl: tcpdump: Fix missing sanity check for batman-adv header

parse_eth_hdr() is assuming that every ETH_P_BATMAN ethernet packet has a valid, minimal batman-adv header (packet_type, version, ttl) attached. But it doesn't actually check if the received buffer has enough bytes to access the two bytes packet_type + version. So it is possible that it tries to read outside of the received data.

Fixes: 3bdfc388e74b ("implement simple tcpdump, first only batman packets") Signed-off-by: Sven Eckelmann sven@narfation.org

7ae3bdb59a7501197e12d3a7ab0d9924341e9ca8 tcpdump.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/tcpdump.c b/tcpdump.c index 5e7c76c..e1ed754 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -1167,6 +1167,9 @@ static void parse_eth_hdr(unsigned char *packet_buff, ssize_t buff_len, int read dump_vlan(packet_buff, buff_len, read_opt, time_printed); break; case ETH_P_BATMAN: + /* check for batman-adv packet_type + version */ + LEN_CHECK(buff_len, sizeof(*eth_hdr) + 2, "BAT HEADER") + batman_ogm_packet = (struct batadv_ogm_packet *)(packet_buff + ETH_HLEN);

if ((read_opt & COMPAT_FILTER) &&