remalloc packets before padding to ensure not overwriting memory - cl…

…oses appneta#80
baigubulu · Jul 22, 2014 · 69831b8 · 69831b8
1 parent 16abc7f
commit 69831b8
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 4 deletions.
diff --git a/docs/CHANGELOG b/docs/CHANGELOG
@@ -4,6 +4,7 @@
     - Fix max replay rate for all loops except first when omitting --mbps (#85)
     - Seg fault on some IPv6 files when using -C option with tcprewrite (#83)
     - Support for PF_RING DNA version of libpcap (#82)
+    - Fix segfault when using '-F pad' (#80)
     - Fix build for FreeBSD version 8.4 (#78)
 
 06/19/2014 Version 4.0.5-beta1

diff --git a/src/tcpedit/edit_packet.c b/src/tcpedit/edit_packet.c
@@ -241,13 +241,17 @@ randomize_ipv6(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
 
 int
 untrunc_packet(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr, 
-        u_char *pktdata, ipv4_hdr_t *ip_hdr, ipv6_hdr_t *ip6_hdr)
+        u_char **pktdata, ipv4_hdr_t *ip_hdr, ipv6_hdr_t *ip6_hdr)
 {
     int l2len;
+    u_char *packet;
     assert(tcpedit);
     assert(pkthdr);
     assert(pktdata);
 
+    packet = *pktdata;
+    assert(packet);
+
     /* if actual len == cap len or there's no IP header, don't do anything */
     if ((pkthdr->caplen == pkthdr->len) || (ip_hdr == NULL && ip6_hdr == NULL)) {
         /* unless we're in MTU truncate mode */
@@ -268,7 +272,8 @@ untrunc_packet(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
   	     * which seems like a corrupted pcap
   	     */
         if (pkthdr->len > pkthdr->caplen) {
-            memset(pktdata + pkthdr->caplen, '\0', pkthdr->len - pkthdr->caplen);
+            packet = safe_realloc(packet, pkthdr->len);
+            memset(packet + pkthdr->caplen, '\0', pkthdr->len - pkthdr->caplen);
             pkthdr->caplen = pkthdr->len;
         } else if (pkthdr->len < pkthdr->caplen) {
             /* i guess this is necessary if we've got a bogus pcap */

diff --git a/src/tcpedit/edit_packet.h b/src/tcpedit/edit_packet.h
@@ -25,7 +25,7 @@
 #include "common.h"
 
 int untrunc_packet(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr, 
-        u_char *pktdata, ipv4_hdr_t *ip_hdr, ipv6_hdr_t *ip6_hdr);
+        u_char **pktdata, ipv4_hdr_t *ip_hdr, ipv6_hdr_t *ip6_hdr);
 
 int randomize_ipv4(tcpedit_t *tcpedit, struct pcap_pkthdr *pktdhr, 
         u_char *pktdata, ipv4_hdr_t *ip_hdr);

diff --git a/src/tcpedit/tcpedit.c b/src/tcpedit/tcpedit.c
@@ -223,7 +223,7 @@ tcpedit_packet(tcpedit_t *tcpedit, struct pcap_pkthdr **pkthdr,
 
     /* (Un)truncate or MTU truncate packet? */
     if (tcpedit->fixlen || tcpedit->mtu_truncate) {
-        if ((retval = untrunc_packet(tcpedit, *pkthdr, packet, ip_hdr, ip6_hdr)) < 0)
+        if ((retval = untrunc_packet(tcpedit, *pkthdr, pktdata, ip_hdr, ip6_hdr)) < 0)
             return TCPEDIT_ERROR;
         needtorecalc += retval;
     }