Skip to content

Commit cbddb98

Browse files
guyharrisinfrastation
authored andcommitted
CVE-2017-13002/AODV: Add some missing bounds checks.
In aodv_extension() do a bounds check on the extension header before we look at it. This fixes a buffer over-read discovered by Kamil Frankowicz. Add a test using the capture file supplied by the reporter(s). While we're at it, add the RFC number, and check the validity of the length for the Hello extension.
1 parent 7a92344 commit cbddb98

File tree

4 files changed

+11
-1
lines changed

4 files changed

+11
-1
lines changed

Diff for: print-aodv.c

+8-1
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,9 @@
4242
#include "addrtoname.h"
4343
#include "extract.h"
4444

45-
45+
/*
46+
* RFC 3561
47+
*/
4648
struct aodv_rreq {
4749
uint8_t rreq_type; /* AODV message type (1) */
4850
uint8_t rreq_flags; /* various flags */
@@ -178,12 +180,17 @@ aodv_extension(netdissect_options *ndo,
178180
{
179181
const struct aodv_hello *ah;
180182

183+
ND_TCHECK(*ep);
181184
switch (ep->type) {
182185
case AODV_EXT_HELLO:
183186
ah = (const struct aodv_hello *)(const void *)ep;
184187
ND_TCHECK(*ah);
185188
if (length < sizeof(struct aodv_hello))
186189
goto trunc;
190+
if (ep->length < 4) {
191+
ND_PRINT((ndo, "\n\text HELLO - bad length %u", ep->length));
192+
break;
193+
}
187194
ND_PRINT((ndo, "\n\text HELLO %ld ms",
188195
(unsigned long)EXTRACT_32BITS(&ah->interval)));
189196
break;

Diff for: tests/TESTLIST

+1
Original file line numberDiff line numberDiff line change
@@ -459,6 +459,7 @@ hoobr_chdlc_print hoobr_chdlc_print.pcap hoobr_chdlc_print.out
459459
hoobr_lookup_nsap hoobr_lookup_nsap.pcap hoobr_lookup_nsap.out
460460
hoobr_rt6_print hoobr_rt6_print.pcap hoobr_rt6_print.out
461461
hoobr_nfs_printfh hoobr_nfs_printfh.pcap hoobr_nfs_printfh.out
462+
hoobr_aodv_extension hoobr_aodv_extension.pcap hoobr_aodv_extension.out
462463

463464
# bad packets from Wilfried Kirsch
464465
slip-bad-direction slip-bad-direction.pcap slip-bad-direction.out -ve

Diff for: tests/hoobr_aodv_extension.out

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
IP 48.48.48.48.654 > 48.48.48.48.12336: aodv rrep 12308 prefix 16 hops 48
2+
dst 48.48.48.48 dseq 808464432 src 48.48.48.48 808464432 ms [|hello]

Diff for: tests/hoobr_aodv_extension.pcap

122 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)