Skip to content

Commit 21e4462

Browse files
author
Gabriel Ganne
committed
remove all the asserts on packet length
Signed-off-by: Gabriel Ganne <[email protected]>
1 parent 41b6d36 commit 21e4462

File tree

14 files changed

+171
-85
lines changed

14 files changed

+171
-85
lines changed

‎src/tcpedit/plugins/dlt_en10mb/en10mb.c

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,8 @@ dlt_en10mb_decode(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
275275

276276
assert(ctx);
277277
assert(packet);
278-
assert(pktlen >= 14);
278+
if (pktlen < 14)
279+
return TCPEDIT_ERROR;
279280

280281
/* get our src & dst address */
281282
eth = (struct tcpr_ethernet_hdr *)packet;
@@ -499,7 +500,8 @@ dlt_en10mb_proto(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
499500

500501
assert(ctx);
501502
assert(packet);
502-
assert(pktlen);
503+
if (pktlen < (int) sizeof(*eth))
504+
return TCPEDIT_ERROR;
503505

504506
eth = (struct tcpr_ethernet_hdr *)packet;
505507
switch (ntohs(eth->ether_type)) {
@@ -524,9 +526,12 @@ dlt_en10mb_get_layer3(tcpeditdlt_t *ctx, u_char *packet, const int pktlen)
524526
int l2len;
525527
assert(ctx);
526528
assert(packet);
527-
assert(pktlen);
528529

529530
l2len = dlt_en10mb_l2len(ctx, packet, pktlen);
531+
532+
if (pktlen < l2len)
533+
return NULL;
534+
530535
return tcpedit_dlt_l3data_copy(ctx, packet, pktlen, l2len);
531536
}
532537

@@ -546,7 +551,8 @@ dlt_en10mb_merge_layer3(tcpeditdlt_t *ctx, u_char *packet, const int pktlen, u_c
546551

547552
l2len = dlt_en10mb_l2len(ctx, packet, pktlen);
548553

549-
assert(pktlen >= l2len);
554+
if (pktlen < l2len)
555+
return NULL;
550556

551557
return tcpedit_dlt_l3data_merge(ctx, packet, pktlen, l3data, l2len);
552558
}
@@ -560,7 +566,8 @@ dlt_en10mb_get_mac(tcpeditdlt_t *ctx, tcpeditdlt_mac_type_t mac, const u_char *p
560566
{
561567
assert(ctx);
562568
assert(packet);
563-
assert(pktlen);
569+
if (pktlen < 14)
570+
return NULL;
564571

565572
/* FIXME: return a ptr to the source or dest mac address. */
566573
switch(mac) {

‎src/tcpedit/plugins/dlt_hdlc/hdlc.c

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,9 @@ dlt_hdlc_decode(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
190190
hdlc_extra_t *extra;
191191
assert(ctx);
192192
assert(packet);
193-
assert(pktlen >= 4);
193+
194+
if (pktlen < 4)
195+
return TCPEDIT_ERROR;
194196

195197
extra = (hdlc_extra_t *)ctx->decoded_extra;
196198
hdlc = (cisco_hdlc_t *)packet;
@@ -219,9 +221,11 @@ dlt_hdlc_encode(tcpeditdlt_t *ctx, u_char *packet, int pktlen, _U_ tcpr_dir_t di
219221
int newpktlen;
220222

221223
assert(ctx);
222-
assert(pktlen >= 4);
223224
assert(packet);
224225

226+
if (pktlen < 4)
227+
return TCPEDIT_ERROR;
228+
225229
/* Make room for our new l2 header if old l2len != 4 */
226230
if (ctx->l2len > 4) {
227231
memmove(packet + 4, packet + ctx->l2len, pktlen - ctx->l2len);
@@ -277,7 +281,9 @@ dlt_hdlc_proto(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
277281
cisco_hdlc_t *hdlc;
278282
assert(ctx);
279283
assert(packet);
280-
assert(pktlen >= 4);
284+
285+
if (pktlen < 4)
286+
return TCPEDIT_ERROR;
281287

282288
hdlc = (cisco_hdlc_t *)packet;
283289

@@ -297,7 +303,8 @@ dlt_hdlc_get_layer3(tcpeditdlt_t *ctx, u_char *packet, const int pktlen)
297303
/* FIXME: Is there anything else we need to do?? */
298304
l2len = dlt_hdlc_l2len(ctx, packet, pktlen);
299305

300-
assert(pktlen >= l2len);
306+
if (pktlen < l2len)
307+
return NULL;
301308

302309
return tcpedit_dlt_l3data_copy(ctx, packet, pktlen, l2len);
303310
}
@@ -319,7 +326,8 @@ dlt_hdlc_merge_layer3(tcpeditdlt_t *ctx, u_char *packet, const int pktlen, u_cha
319326
/* FIXME: Is there anything else we need to do?? */
320327
l2len = dlt_hdlc_l2len(ctx, packet, pktlen);
321328

322-
assert(pktlen >= l2len);
329+
if (pktlen < l2len)
330+
return NULL;
323331

324332
return tcpedit_dlt_l3data_merge(ctx, packet, pktlen, l3data, l2len);
325333
}
@@ -332,7 +340,9 @@ dlt_hdlc_l2len(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
332340
{
333341
assert(ctx);
334342
assert(packet);
335-
assert(pktlen);
343+
344+
if (pktlen < 4)
345+
return 0;
336346

337347
/* HDLC is a static 4 bytes */
338348
return 4;
@@ -347,7 +357,9 @@ dlt_hdlc_get_mac(tcpeditdlt_t *ctx, tcpeditdlt_mac_type_t mac, const u_char *pac
347357
{
348358
assert(ctx);
349359
assert(packet);
350-
assert(pktlen);
360+
361+
if (pktlen < 14)
362+
return NULL;
351363

352364
/* FIXME: return a ptr to the source or dest mac address. */
353365
switch(mac) {

‎src/tcpedit/plugins/dlt_ieee80211/ieee80211.c

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -179,9 +179,15 @@ dlt_ieee80211_parse_opts(tcpeditdlt_t *ctx)
179179
int
180180
dlt_ieee80211_decode(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
181181
{
182+
int l2len;
183+
182184
assert(ctx);
183185
assert(packet);
184-
assert(pktlen >= dlt_ieee80211_l2len(ctx, packet, pktlen));
186+
187+
l2len = dlt_ieee80211_l2len(ctx, packet, pktlen);
188+
189+
if (pktlen < l2len)
190+
return TCPEDIT_ERROR;
185191

186192
dbgx(3, "Decoding 802.11 packet " COUNTER_SPEC, ctx->tcpedit->runtime.packetnum);
187193
if (! ieee80211_is_data(ctx, packet, pktlen)) {
@@ -196,7 +202,7 @@ dlt_ieee80211_decode(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
196202
return TCPEDIT_SOFT_ERROR;
197203
}
198204

199-
ctx->l2len = dlt_ieee80211_l2len(ctx, packet, pktlen);
205+
ctx->l2len = l2len;
200206
memcpy(&(ctx->srcaddr), ieee80211_get_src((ieee80211_hdr_t *)packet), ETHER_ADDR_LEN);
201207
memcpy(&(ctx->dstaddr), ieee80211_get_dst((ieee80211_hdr_t *)packet), ETHER_ADDR_LEN);
202208
ctx->proto = dlt_ieee80211_proto(ctx, packet, pktlen);
@@ -212,7 +218,6 @@ int
212218
dlt_ieee80211_encode(tcpeditdlt_t *ctx, u_char *packet, int pktlen, _U_ tcpr_dir_t dir)
213219
{
214220
assert(ctx);
215-
assert(pktlen);
216221
assert(packet);
217222

218223
tcpedit_seterr(ctx->tcpedit, "%s", "DLT_IEEE802_11 plugin does not support packet encoding");
@@ -234,7 +239,8 @@ dlt_ieee80211_proto(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
234239
assert(packet);
235240

236241
l2len = dlt_ieee80211_l2len(ctx, packet, pktlen);
237-
assert(pktlen >= l2len);
242+
if (pktlen < l2len)
243+
return TCPEDIT_ERROR;
238244

239245
/* check 802.11 frame control field */
240246
frame_control = (uint16_t *)packet;
@@ -281,9 +287,11 @@ dlt_ieee80211_get_layer3(tcpeditdlt_t *ctx, u_char *packet, const int pktlen)
281287

282288
l2len = dlt_ieee80211_l2len(ctx, packet, pktlen);
283289

284-
assert(pktlen >= l2len);
290+
if (pktlen < l2len)
291+
return NULL;
292+
285293
dbgx(1, "Getting data for packet " COUNTER_SPEC " from offset: %d", ctx->tcpedit->runtime.packetnum, l2len);
286-
294+
287295
return tcpedit_dlt_l3data_copy(ctx, packet, pktlen, l2len);
288296
}
289297

@@ -301,10 +309,10 @@ dlt_ieee80211_merge_layer3(tcpeditdlt_t *ctx, u_char *packet, const int pktlen,
301309
assert(packet);
302310
assert(l3data);
303311

304-
305312
l2len = dlt_ieee80211_l2len(ctx, packet, pktlen);
306313

307-
assert(pktlen >= l2len);
314+
if (pktlen < l2len)
315+
return NULL;
308316

309317
return tcpedit_dlt_l3data_merge(ctx, packet, pktlen, l3data, l2len);
310318
}
@@ -323,14 +331,15 @@ dlt_ieee80211_l2len(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
323331

324332
assert(ctx);
325333
assert(packet);
326-
assert(pktlen);
327-
334+
335+
if (pktlen < (int)sizeof(uint16_t))
336+
return 0;
337+
328338
dbgx(2, "packet = %p\t\tplen = %d", packet, pktlen);
329339

330340
frame_control = (uint16_t *)packet;
331341
fc = ntohs(*frame_control);
332342

333-
334343
if (ieee80211_USE_4(fc)) {
335344
hdrlen = sizeof(ieee80211_addr4_hdr_t);
336345
} else {
@@ -356,6 +365,9 @@ dlt_ieee80211_l2len(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
356365
dbgx(2, "total header length (802.11 + 802.2): %d (%02x/%02x)", hdrlen, hdr->snap_dsap, hdr->snap_ssap);
357366
}
358367
}
368+
369+
if (pktlen < hdrlen)
370+
return 0;
359371

360372
dbgx(2, "header length: %d", hdrlen);
361373
return hdrlen;
@@ -370,8 +382,10 @@ dlt_ieee80211_get_mac(tcpeditdlt_t *ctx, tcpeditdlt_mac_type_t mac, const u_char
370382
{
371383
assert(ctx);
372384
assert(packet);
373-
assert(pktlen);
374385
u_char *macaddr;
386+
387+
if (pktlen < 14)
388+
return NULL;
375389

376390
switch(mac) {
377391
case SRC_MAC:

‎src/tcpedit/plugins/dlt_ieee80211/ieee80211_hdr.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,9 @@ ieee80211_is_encrypted(tcpeditdlt_t *ctx, const void *packet, const int pktlen)
121121

122122
assert(ctx);
123123
assert(packet);
124-
assert(pktlen >= (int)sizeof(ieee80211_hdr_t));
124+
125+
if (pktlen < (int)sizeof(ieee80211_hdr_t))
126+
return 0;
125127

126128
frame_control = (uint16_t *)packet;
127129
fc = ntohs(*frame_control);

‎src/tcpedit/plugins/dlt_jnpr_ether/jnpr_ether.c

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,10 @@ dlt_jnpr_ether_decode(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
214214

215215
assert(ctx);
216216
assert(packet);
217-
assert(pktlen > JUNIPER_ETHER_HEADER_LEN); /* MAGIC + Static fields + Extension Length */
217+
218+
/* MAGIC + Static fields + Extension Length */
219+
if (pktlen < JUNIPER_ETHER_HEADER_LEN)
220+
return TCPEDIT_ERROR;
218221

219222
config = (jnpr_ether_config_t *)ctx->encoder->config;
220223

@@ -272,8 +275,11 @@ int
272275
dlt_jnpr_ether_encode(tcpeditdlt_t *ctx, u_char *packet, int pktlen, _U_ tcpr_dir_t dir)
273276
{
274277
assert(ctx);
275-
assert(pktlen > JUNIPER_ETHER_HEADER_LEN); /* MAGIC + Static fields + Extension Length */
276278
assert(packet);
279+
280+
/* MAGIC + Static fields + Extension Length */
281+
if (pktlen < JUNIPER_ETHER_HEADER_LEN)
282+
return TCPEDIT_ERROR;
277283

278284
tcpedit_seterr(ctx->tcpedit, "%s", "DLT_JUNIPER_ETHER plugin does not support packet encoding");
279285
return TCPEDIT_ERROR;
@@ -292,7 +298,10 @@ dlt_jnpr_ether_proto(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
292298

293299
assert(ctx);
294300
assert(packet);
295-
assert(pktlen > JUNIPER_ETHER_HEADER_LEN); /* MAGIC + Static fields + Extension Length */
301+
302+
/* MAGIC + Static fields + Extension Length */
303+
if (pktlen < JUNIPER_ETHER_HEADER_LEN)
304+
return TCPEDIT_ERROR;
296305

297306
config = (jnpr_ether_config_t *)ctx->encoder->config;
298307

@@ -335,7 +344,8 @@ dlt_jnpr_ether_get_layer3(tcpeditdlt_t *ctx, u_char *packet, const int pktlen)
335344

336345
l2len = dlt_jnpr_ether_l2len(ctx, packet, pktlen);
337346

338-
assert(pktlen >= l2len);
347+
if (pktlen < l2len)
348+
return NULL;
339349

340350
return tcpedit_dlt_l3data_copy(ctx, packet, pktlen, l2len);
341351
}
@@ -356,7 +366,8 @@ dlt_jnpr_ether_merge_layer3(tcpeditdlt_t *ctx, u_char *packet, const int pktlen,
356366

357367
l2len = dlt_jnpr_ether_l2len(ctx, packet, pktlen);
358368

359-
assert(pktlen >= l2len);
369+
if (pktlen < l2len)
370+
return NULL;
360371

361372
return tcpedit_dlt_l3data_merge(ctx, packet, pktlen, l3data, l2len);
362373
}
@@ -374,7 +385,9 @@ dlt_jnpr_ether_get_mac(tcpeditdlt_t *ctx, tcpeditdlt_mac_type_t mac, const u_cha
374385

375386
assert(ctx);
376387
assert(packet);
377-
assert(pktlen);
388+
389+
if (pktlen < JUNIPER_ETHER_EXTLEN_OFFSET + 2)
390+
return NULL;
378391

379392
config = (jnpr_ether_config_t *)ctx->encoder->config;
380393

@@ -399,7 +412,9 @@ dlt_jnpr_ether_l2len(tcpeditdlt_t *ctx, const u_char *packet, const int pktlen)
399412

400413
assert(ctx);
401414
assert(packet);
402-
assert(pktlen);
415+
416+
if (pktlen < JUNIPER_ETHER_EXTLEN_OFFSET + 2)
417+
return 0;
403418

404419
config = (jnpr_ether_config_t *)ctx->encoder->config;
405420

0 commit comments

Comments
 (0)