From 4848eb3af2a91b133c4b70cb9b71dd92ffec7f46 Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Mon, 1 Apr 2024 11:42:14 +0200 Subject: [PATCH] tcpdump: cope with incorrect packet lengths It's possible for the capture buffer to be smaller than indicated by the header length. However, pfsync_print() only took the header length into account. As a result we could read outside of the buffer. Check that we have at least the expected amount of data before we start parsing. PR: 278034 MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D44580 --- contrib/tcpdump/print-pfsync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/tcpdump/print-pfsync.c b/contrib/tcpdump/print-pfsync.c index 5710e36ded6..6bf9abaf390 100644 --- a/contrib/tcpdump/print-pfsync.c +++ b/contrib/tcpdump/print-pfsync.c @@ -86,7 +86,7 @@ pfsync_ip_print(netdissect_options *ndo , const u_char *bp, u_int len) { struct pfsync_header *hdr = (struct pfsync_header *)bp; - if (len < PFSYNC_HDRLEN) + if (len < PFSYNC_HDRLEN || !ND_TTEST_LEN(bp, len)) ND_PRINT("[|pfsync]"); else pfsync_print(ndo, hdr, bp + sizeof(struct pfsync_header),