Skip to content
Permalink
Browse files Browse the repository at this point in the history
do sanity checks on PHB header length before allocating memory. There…
… was no fault; but doing the check results in a more consistent error
  • Loading branch information
mcr authored and guyharris committed Sep 30, 2019
1 parent 449d952 commit 87d6bef
Showing 1 changed file with 10 additions and 16 deletions.
26 changes: 10 additions & 16 deletions sf-pcapng.c
Expand Up @@ -85,7 +85,7 @@ struct option_header {
* Section Header Block.
*/
#define BT_SHB 0x0A0D0D0A

#define BT_SHB_INSANE_MAX 1024*1024*1 /* 1MB should be enough */
struct section_header_block {
bpf_u_int32 byte_order_magic;
u_short major_version;
Expand Down Expand Up @@ -266,7 +266,7 @@ read_bytes(FILE *fp, void *buf, size_t bytes_to_read, int fail_on_eof,
if (amt_read == 0 && !fail_on_eof)
return (0); /* EOF */
pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
"truncated dump file; tried to read %" PRIsize " bytes, only got %" PRIsize,
"truncated pcapng dump file; tried to read %" PRIsize " bytes, only got %" PRIsize,
bytes_to_read, amt_read);
}
return (-1);
Expand Down Expand Up @@ -856,26 +856,20 @@ pcap_ng_check_header(const uint8_t *magic, FILE *fp, u_int precision,
/*
* Check the sanity of the total length.
*/
if (total_length < sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer)) {
if (total_length < sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer) ||
(total_length > BT_SHB_INSANE_MAX)) {
pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
"Section Header Block in pcapng dump file has a length of %u < %" PRIsize,
total_length,
sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer));
*err = 1;
return (NULL);
}
"Section Header Block in pcapng dump file has invalid length %" PRIsize " < _%lu_ < %lu (BT_SHB_INSANE_MAX)",
sizeof(*bhdrp) + sizeof(*shbp) + sizeof(struct block_trailer),
total_length,
BT_SHB_INSANE_MAX);

/*
* Make sure it's not too big.
*/
if (total_length > INITIAL_MAX_BLOCKSIZE) {
pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE,
"pcapng block size %u > maximum %u",
total_length, INITIAL_MAX_BLOCKSIZE);
*err = 1;
return (NULL);
}



/*
* OK, this is a good pcapng file.
* Allocate a pcap_t for it.
Expand Down

0 comments on commit 87d6bef

Please sign in to comment.