Changeset 15f32cb

Timestamp:

01/14/19 17:32:34 (2 years ago)

Author:

Shane Alcock <salcock@…>

Branches:

develop

Children:

d0941cc

Parents:

5460603

Message:

Fix potential buffer overflow in pcapng:

Fixes #95.

File:

• lib/format_pcapng.c (modified) (3 diffs)

lib/format_pcapng.c

@@ -1158 +1158 @@
         pcapng_sec_t *sechdr;
         int err;
-        uint32_t to_read;
+        uint32_t to_read, blocklen;
         char *bodyptr = NULL;
 
@@ -1202 +1202 @@
                         return -1;
                 }
-                to_read = byteswap32(sechdr->blocklen) - sizeof(pcapng_sec_t);
+                blocklen = byteswap32(sechdr->blocklen);
+
         } else {
                 if (sechdr->majorversion != 1 && sechdr->minorversion != 0) {
@@ -1209 +1210 @@
                         return -1;
                 }
-                to_read = sechdr->blocklen - sizeof(pcapng_sec_t);
-        }
-
+                blocklen = sechdr->blocklen;
+        }
+
+        if (blocklen < sizeof(pcapng_sec_t)) {
+                trace_set_err(libtrace, TRACE_ERR_BAD_PACKET,
+                                "Block length in pcapng section header is invalid.");
+                return -1;
+        }
+        to_read = blocklen - sizeof(pcapng_sec_t);
         /* Read all of the options etc. -- we don't need them for now, but
          * we have to skip forward to the next useful header. */