Skip to content

Commit bea2686

Browse files
committed
(for 4.9.3) CVE-2018-14465/RSVP: Add a missing bounds check
In rsvp_obj_print(). This fixes a buffer over-read discovered by Bhargava Shastry. Add a test using the capture file supplied by the reporter(s).
1 parent 1a1bce0 commit bea2686

File tree

4 files changed

+9
-0
lines changed

4 files changed

+9
-0
lines changed

Diff for: print-rsvp.c

+1
Original file line numberDiff line numberDiff line change
@@ -1555,6 +1555,7 @@ rsvp_obj_print(netdissect_options *ndo,
15551555
case RSVP_OBJ_CLASSTYPE_OLD: /* fall through */
15561556
switch(rsvp_obj_ctype) {
15571557
case RSVP_CTYPE_1:
1558+
ND_TCHECK_32BITS(obj_tptr);
15581559
ND_PRINT((ndo, "%s CT: %u",
15591560
ident,
15601561
EXTRACT_32BITS(obj_tptr) & 0x7));

Diff for: tests/TESTLIST

+1
Original file line numberDiff line numberDiff line change
@@ -555,6 +555,7 @@ isakmp-ikev1_n_print-oobr isakmp-ikev1_n_print-oobr.pcap isakmp-ikev1_n_print-oo
555555
ldp-ldp_tlv_print-oobr ldp-ldp_tlv_print-oobr.pcap ldp-ldp_tlv_print-oobr.out -v -c1
556556
icmp-icmp_print-oobr-1 icmp-icmp_print-oobr-1.pcap icmp-icmp_print-oobr-1.out -v -c3
557557
icmp-icmp_print-oobr-2 icmp-icmp_print-oobr-2.pcap icmp-icmp_print-oobr-2.out -v -c3
558+
rsvp-rsvp_obj_print-oobr rsvp-rsvp_obj_print-oobr.pcap rsvp-rsvp_obj_print-oobr.out -v -c3
558559
# The .pcap file is truncated after the 1st packet.
559560
hncp_dhcpv6data-oobr hncp_dhcpv6data-oobr.pcap hncp_dhcpv6data-oobr.out -v -c1
560561
hncp_dhcpv4data-oobr hncp_dhcpv4data-oobr.pcap hncp_dhcpv4data-oobr.out -v -c1

Diff for: tests/rsvp-rsvp_obj_print-oobr.out

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
TIPC v5.0 226.0.0 > 64.14.1536, headerlength 56 bytes, MessageSize 51914 bytes, Link Changeover Protocol internal, messageType Unknown (0xcacacaca)[|TIPC]
2+
[|ether]
3+
IP (tos 0x0, ttl 14, id 44815, offset 0, flags [+, DF, rsvd], proto RSVP (46), length 40, bad cksum 3280 (->c411)!)
4+
250.219.91.71 > 20.100.238.255:
5+
RSVPv1 Hello Message (20), Flags: [none], length: 16384, ttl: 0, checksum: 0x000e
6+
Class Type (old) Object (125) Flags: [reject if unknown], Class-Type: 1 (1), length: 4
7+
[|rsvp]

Diff for: tests/rsvp-rsvp_obj_print-oobr.pcap

391 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)