Skip to content

Commit 1dcd10a

Browse files
guyharrisinfrastation
authored andcommitted
CVE-2017-12897/ISO CLNS: Use ND_TTEST() for the bounds checks in isoclns_print().
This fixes a buffer over-read discovered by Kamil Frankowicz. Don't pass the remaining caplen - that's too hard to get right, and we were getting it wrong in at least one case; just use ND_TTEST(). Add a test using the capture file supplied by the reporter(s).
1 parent f76e7fe commit 1dcd10a

15 files changed

+27
-26
lines changed

Diff for: netdissect.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -512,7 +512,7 @@ extern void ipx_netbios_print(netdissect_options *, const u_char *, u_int);
512512
extern void ipx_print(netdissect_options *, const u_char *, u_int);
513513
extern void isakmp_print(netdissect_options *, const u_char *, u_int, const u_char *);
514514
extern void isakmp_rfc3948_print(netdissect_options *, const u_char *, u_int, const u_char *);
515-
extern void isoclns_print(netdissect_options *, const u_char *, u_int, u_int);
515+
extern void isoclns_print(netdissect_options *, const u_char *, u_int);
516516
extern void krb_print(netdissect_options *, const u_char *);
517517
extern void l2tp_print(netdissect_options *, const u_char *, u_int);
518518
extern void lane_print(netdissect_options *, const u_char *, u_int, u_int);

Diff for: print-atm.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ atm_if_print(netdissect_options *ndo,
262262
if (*p == LLC_UI) {
263263
if (ndo->ndo_eflag)
264264
ND_PRINT((ndo, "CNLPID "));
265-
isoclns_print(ndo, p + 1, length - 1, caplen - 1);
265+
isoclns_print(ndo, p + 1, length - 1);
266266
return hdrlen;
267267
}
268268

Diff for: print-chdlc.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -97,9 +97,9 @@ chdlc_print(netdissect_options *ndo, register const u_char *p, u_int length)
9797
if (*(p+1) == 0x81 ||
9898
*(p+1) == 0x82 ||
9999
*(p+1) == 0x83)
100-
isoclns_print(ndo, p + 1, length - 1, ndo->ndo_snapend - p - 1);
100+
isoclns_print(ndo, p + 1, length - 1);
101101
else
102-
isoclns_print(ndo, p, length, ndo->ndo_snapend - p);
102+
isoclns_print(ndo, p, length);
103103
break;
104104
default:
105105
if (!ndo->ndo_eflag)

Diff for: print-ether.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ ethertype_print(netdissect_options *ndo,
367367
ND_PRINT((ndo, " [|osi]"));
368368
return (1);
369369
}
370-
isoclns_print(ndo, p + 1, length - 1, caplen - 1);
370+
isoclns_print(ndo, p + 1, length - 1);
371371
return(1);
372372

373373
case ETHERTYPE_PPPOED:

Diff for: print-fr.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -329,7 +329,7 @@ fr_print(netdissect_options *ndo,
329329
case NLPID_CLNP:
330330
case NLPID_ESIS:
331331
case NLPID_ISIS:
332-
isoclns_print(ndo, p - 1, length + 1, ndo->ndo_snapend - p + 1); /* OSI printers need the NLPID field */
332+
isoclns_print(ndo, p - 1, length + 1); /* OSI printers need the NLPID field */
333333
break;
334334

335335
case NLPID_SNAP:

Diff for: print-gre.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ gre_print_0(netdissect_options *ndo, const u_char *bp, u_int length)
227227
atalk_print(ndo, bp, len);
228228
break;
229229
case ETHERTYPE_GRE_ISO:
230-
isoclns_print(ndo, bp, len, ndo->ndo_snapend - bp);
230+
isoclns_print(ndo, bp, len);
231231
break;
232232
case ETHERTYPE_TEB:
233233
ether_print(ndo, bp, len, ndo->ndo_snapend - bp, NULL, NULL);

Diff for: print-isoclns.c

+6-7
Original file line numberDiff line numberDiff line change
@@ -670,10 +670,9 @@ struct isis_tlv_lsp {
670670
#define ISIS_PSNP_HEADER_SIZE (sizeof(struct isis_psnp_header))
671671

672672
void
673-
isoclns_print(netdissect_options *ndo,
674-
const uint8_t *p, u_int length, u_int caplen)
673+
isoclns_print(netdissect_options *ndo, const uint8_t *p, u_int length)
675674
{
676-
if (caplen <= 1) { /* enough bytes on the wire ? */
675+
if (!ND_TTEST(*p)) { /* enough bytes on the wire ? */
677676
ND_PRINT((ndo, "|OSI"));
678677
return;
679678
}
@@ -685,7 +684,7 @@ isoclns_print(netdissect_options *ndo,
685684

686685
case NLPID_CLNP:
687686
if (!clnp_print(ndo, p, length))
688-
print_unknown_data(ndo, p, "\n\t", caplen);
687+
print_unknown_data(ndo, p, "\n\t", length);
689688
break;
690689

691690
case NLPID_ESIS:
@@ -694,7 +693,7 @@ isoclns_print(netdissect_options *ndo,
694693

695694
case NLPID_ISIS:
696695
if (!isis_print(ndo, p, length))
697-
print_unknown_data(ndo, p, "\n\t", caplen);
696+
print_unknown_data(ndo, p, "\n\t", length);
698697
break;
699698

700699
case NLPID_NULLNS:
@@ -721,8 +720,8 @@ isoclns_print(netdissect_options *ndo,
721720
if (!ndo->ndo_eflag)
722721
ND_PRINT((ndo, "OSI NLPID 0x%02x unknown", *p));
723722
ND_PRINT((ndo, "%slength: %u", ndo->ndo_eflag ? "" : ", ", length));
724-
if (caplen > 1)
725-
print_unknown_data(ndo, p, "\n\t", caplen);
723+
if (length > 1)
724+
print_unknown_data(ndo, p, "\n\t", length);
726725
break;
727726
}
728727
}

Diff for: print-juniper.c

+8-8
Original file line numberDiff line numberDiff line change
@@ -793,7 +793,7 @@ juniper_mlppp_print(netdissect_options *ndo,
793793
mpls_print(ndo, p, l2info.length);
794794
return l2info.header_len;
795795
case JUNIPER_LSQ_L3_PROTO_ISO:
796-
isoclns_print(ndo, p, l2info.length, l2info.caplen);
796+
isoclns_print(ndo, p, l2info.length);
797797
return l2info.header_len;
798798
default:
799799
break;
@@ -848,7 +848,7 @@ juniper_mfr_print(netdissect_options *ndo,
848848
mpls_print(ndo, p, l2info.length);
849849
return l2info.header_len;
850850
case JUNIPER_LSQ_L3_PROTO_ISO:
851-
isoclns_print(ndo, p, l2info.length, l2info.caplen);
851+
isoclns_print(ndo, p, l2info.length);
852852
return l2info.header_len;
853853
default:
854854
break;
@@ -861,13 +861,13 @@ juniper_mfr_print(netdissect_options *ndo,
861861
ND_PRINT((ndo, "Bundle-ID %u, ", l2info.bundle));
862862
switch (l2info.proto) {
863863
case (LLCSAP_ISONS<<8 | LLCSAP_ISONS):
864-
isoclns_print(ndo, p + 1, l2info.length - 1, l2info.caplen - 1);
864+
isoclns_print(ndo, p + 1, l2info.length - 1);
865865
break;
866866
case (LLC_UI<<8 | NLPID_Q933):
867867
case (LLC_UI<<8 | NLPID_IP):
868868
case (LLC_UI<<8 | NLPID_IP6):
869869
/* pass IP{4,6} to the OSI layer for proper link-layer printing */
870-
isoclns_print(ndo, p - 1, l2info.length + 1, l2info.caplen + 1);
870+
isoclns_print(ndo, p - 1, l2info.length + 1);
871871
break;
872872
default:
873873
ND_PRINT((ndo, "unknown protocol 0x%04x, length %u", l2info.proto, l2info.length));
@@ -896,13 +896,13 @@ juniper_mlfr_print(netdissect_options *ndo,
896896
switch (l2info.proto) {
897897
case (LLC_UI):
898898
case (LLC_UI<<8):
899-
isoclns_print(ndo, p, l2info.length, l2info.caplen);
899+
isoclns_print(ndo, p, l2info.length);
900900
break;
901901
case (LLC_UI<<8 | NLPID_Q933):
902902
case (LLC_UI<<8 | NLPID_IP):
903903
case (LLC_UI<<8 | NLPID_IP6):
904904
/* pass IP{4,6} to the OSI layer for proper link-layer printing */
905-
isoclns_print(ndo, p - 1, l2info.length + 1, l2info.caplen + 1);
905+
isoclns_print(ndo, p - 1, l2info.length + 1);
906906
break;
907907
default:
908908
ND_PRINT((ndo, "unknown protocol 0x%04x, length %u", l2info.proto, l2info.length));
@@ -949,7 +949,7 @@ juniper_atm1_print(netdissect_options *ndo,
949949
}
950950

951951
if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
952-
isoclns_print(ndo, p + 1, l2info.length - 1, l2info.caplen - 1);
952+
isoclns_print(ndo, p + 1, l2info.length - 1);
953953
/* FIXME check if frame was recognized */
954954
return l2info.header_len;
955955
}
@@ -1004,7 +1004,7 @@ juniper_atm2_print(netdissect_options *ndo,
10041004
}
10051005

10061006
if (p[0] == 0x03) { /* Cisco style NLPID encaps ? */
1007-
isoclns_print(ndo, p + 1, l2info.length - 1, l2info.caplen - 1);
1007+
isoclns_print(ndo, p + 1, l2info.length - 1);
10081008
/* FIXME check if frame was recognized */
10091009
return l2info.header_len;
10101010
}

Diff for: print-llc.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -324,7 +324,7 @@ llc_print(netdissect_options *ndo, const u_char *p, u_int length, u_int caplen,
324324
#endif
325325
if (ssap == LLCSAP_ISONS && dsap == LLCSAP_ISONS
326326
&& control == LLC_UI) {
327-
isoclns_print(ndo, p, length, caplen);
327+
isoclns_print(ndo, p, length);
328328
return (hdrlen);
329329
}
330330

Diff for: print-mpls.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ mpls_print(netdissect_options *ndo, const u_char *bp, u_int length)
201201
break;
202202

203203
case PT_OSI:
204-
isoclns_print(ndo, p, length, length);
204+
isoclns_print(ndo, p, length);
205205
break;
206206

207207
default:

Diff for: print-null.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ null_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char
117117
break;
118118

119119
case BSD_AFNUM_ISO:
120-
isoclns_print(ndo, p, length, caplen);
120+
isoclns_print(ndo, p, length);
121121
break;
122122

123123
case BSD_AFNUM_APPLETALK:

Diff for: print-ppp.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1484,7 +1484,7 @@ handle_ppp(netdissect_options *ndo,
14841484
ipx_print(ndo, p, length);
14851485
break;
14861486
case PPP_OSI:
1487-
isoclns_print(ndo, p, length, length);
1487+
isoclns_print(ndo, p, length);
14881488
break;
14891489
case PPP_MPLS_UCAST:
14901490
case PPP_MPLS_MCAST:

Diff for: tests/TESTLIST

+1
Original file line numberDiff line numberDiff line change
@@ -442,6 +442,7 @@ stp-v4-length-sigsegv stp-v4-length-sigsegv.pcap stp-v4-length-sigsegv.out
442442
hoobr_pimv1 hoobr_pimv1.pcap hoobr_pimv1.out
443443
hoobr_safeputs hoobr_safeputs.pcap hoobr_safeputs.out
444444
isakmp-rfc3948-oobr isakmp-rfc3948-oobr.pcap isakmp-rfc3948-oobr.out
445+
isoclns-oobr isoclns-oobr.pcap isoclns-oobr.out
445446

446447
# bad packets from Wilfried Kirsch
447448
slip-bad-direction slip-bad-direction.pcap slip-bad-direction.out -ve

Diff for: tests/isoclns-oobr.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
|OSI

Diff for: tests/isoclns-oobr.pcap

88 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)