26 lines
1.1 KiB
Diff
26 lines
1.1 KiB
Diff
From: Sven Eckelmann <sven@narfation.org>
|
|
Date: Sat, 27 Jan 2024 13:49:02 +0100
|
|
Subject: batctl: tcpdump: Add missing ICMPv6 Neighbor Advert length check
|
|
|
|
dump_ipv6() is doing a length check for the original ICMPv6 header length.
|
|
But the neighbor advertisement (which is also handled by this function) is
|
|
accessed without doing an additional length check. So it is possible that
|
|
it tries to read outside of the received data.
|
|
|
|
Fixes: 35b37756f4a3 ("add IPv6 support to tcpdump parser")
|
|
Cc: Marco Dalla Torre <marco.dallato@gmail.com>
|
|
Signed-off-by: Sven Eckelmann <sven@narfation.org>
|
|
Origin: upstream, https://git.open-mesh.org/batctl.git/commit/da75747d435ca8a32a74895655a1d5bff8b7709b
|
|
|
|
--- a/tcpdump.c
|
|
+++ b/tcpdump.c
|
|
@@ -611,6 +611,8 @@ static void dump_ipv6(unsigned char *pac
|
|
nd_nas_target, buff_len);
|
|
break;
|
|
case ND_NEIGHBOR_ADVERT:
|
|
+ LEN_CHECK((size_t)buff_len - (size_t)(sizeof(struct ip6_hdr)),
|
|
+ sizeof(*nd_advert), "ICMPv6 Neighbor Advertisement");
|
|
nd_advert = (struct nd_neighbor_advert *)icmphdr;
|
|
inet_ntop(AF_INET6, &(nd_advert->nd_na_target),
|
|
nd_nas_target, 40);
|