lwres: avoid undefined behavior in pointer arithmetic

Check for truncation before doing pointer arithmetic to point to the end of the packet. print-lwres.c:294:10: runtime error: addition of unsigned offset to 0xf3b032be overflowed to 0x9652d560 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior print-lwres.c:294:10 in print-lwres.c:549:29: runtime error: addition of unsigned offset to 0xf3b032be overflowed to 0x9652d560 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior print-lwres.c:549:29 in
the-tcpdump-group · Dec 18, 2022 · a251410 · a251410
1 parent 17195e2
commit a251410
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 1 deletion.
diff --git a/print-lwres.c b/print-lwres.c
@@ -291,7 +291,9 @@ lwres_print(netdissect_options *ndo,
 	if (ndo->ndo_vflag || v != LWRES_LWPACKETVERSION_0)
 		ND_PRINT(" v%u", v);
 	if (v != LWRES_LWPACKETVERSION_0) {
-		s = bp + GET_BE_U_4(np->length);
+		uint32_t pkt_len = GET_BE_U_4(np->length);
+		ND_TCHECK_LEN(bp, pkt_len);
+		s = bp + pkt_len;
 		goto tail;
 	}
 

diff --git a/tests/TESTLIST b/tests/TESTLIST
@@ -915,3 +915,4 @@ bgp-ub  bgp-ub.pcap     bgp-ub.out      -v
 fletcher-checksum-negative-shift fletcher-checksum-negative-shift.pcap fletcher-checksum-negative-shift.out     -v
 ip-snmp-leftshift-unsigned      ip-snmp-leftshift-unsigned.pcap      ip-snmp-leftshift-unsigned.out
 ip6-snmp-oid-unsigned   ip6-snmp-oid-unsigned.pcap      ip6-snmp-oid-unsigned.out
+lwres-pointer-arithmetic-ub	lwres-pointer-arithmetic-ub.pcap	lwres-pointer-arithmetic-ub.out
diff --git a/tests/lwres-pointer-arithmetic-ub.out b/tests/lwres-pointer-arithmetic-ub.out
@@ -0,0 +1 @@
+    1  14:31:29.364332 IP6 fe80:0:10ff:15:1800:1a00:0:100.921 > a00:300:115:1800:1a00:f4:100:a00.0:  lwres v41634 [|lwres]
diff --git a/tests/lwres-pointer-arithmetic-ub.pcap b/tests/lwres-pointer-arithmetic-ub.pcap
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		1 14:31:29.364332 IP6 fe80:0:10ff:15:1800:1a00:0:100.921 > a00:300:115:1800:1a00:f4:100:a00.0: lwres v41634 [\|lwres]