From cebce341c5f3caa621f1a28f9bc30cdd26e949fd Mon Sep 17 00:00:00 2001 From: William Robinet Date: Thu, 3 Sep 2020 19:06:50 +0200 Subject: [PATCH 1/3] Fix segfault by OOB read on malformed packets --- base/network.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/base/network.c b/base/network.c index f6a0109..be52116 100644 --- a/base/network.c +++ b/base/network.c @@ -134,6 +134,12 @@ int network_process_packet(handler,timestamp,data,length) hlen=p.ip->ip_hl * 4; p.data += hlen; p.len = ntohs(p.ip->ip_len); + + if(p.len > length) { + printf("Malformed packet, size from IP header is larger than size reported by libpcap, skipping ...\n"); + return(0); + } + if (p.len == 0) { DBG((0,"ip length reported as 0, presumed to be because of 'TCP segmentation offload' (TSO)\n")); p.len = p._len; From 55510f8fb1cc2db6502da177c177d2fed6caf924 Mon Sep 17 00:00:00 2001 From: William Robinet Date: Thu, 3 Sep 2020 19:07:21 +0200 Subject: [PATCH 2/3] Fix segfault by OOB read on malformed packets (2) --- base/tcppack.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/base/tcppack.c b/base/tcppack.c index bfeb268..fcdc360 100644 --- a/base/tcppack.c +++ b/base/tcppack.c @@ -242,7 +242,12 @@ static int process_data_segment(conn,handler,p,stream,direction) long l; l=p->len - p->tcp->th_off * 4; - + + if(l < 0) { + printf("Malformed packet, computed TCP segment size is negative, skipping ...\n"); + return(0); + } + if(stream->close){ DBG((0,"Rejecting packet received after FIN: %u:%u(%u)", ntohl(p->tcp->th_seq),ntohl(p->tcp->th_seq+l),l)); From 9de6c8b5032fd71ae946283fd808fad70e6f278a Mon Sep 17 00:00:00 2001 From: William Robinet Date: Thu, 3 Sep 2020 19:09:04 +0200 Subject: [PATCH 3/3] Fix multiple segfault by OOB read because of wrong format string specifier --- ssl/ssl.enums.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ssl/ssl.enums.c b/ssl/ssl.enums.c index 592af15..ca1fab6 100644 --- a/ssl/ssl.enums.c +++ b/ssl/ssl.enums.c @@ -240,7 +240,7 @@ static int decode_HandshakeType_ClientHello(ssl,dir,seg,data) if (ssl_decode_switch(ssl,extension_decoder,ex,dir,seg,data) == R_NOT_FOUND) { decode_extension(ssl,dir,seg,data); P_(P_RH){ - explain(ssl, "Extension type: %s not yet implemented in ssldump", ex); + explain(ssl, "Extension type: %u not yet implemented in ssldump\n", ex); } continue; } @@ -300,7 +300,7 @@ static int decode_HandshakeType_ServerHello(ssl,dir,seg,data) if (ssl_decode_switch(ssl,extension_decoder,ex,dir,seg,data) == R_NOT_FOUND) { decode_extension(ssl,dir,seg,data); P_(P_RH){ - explain(ssl, "Extension type: %s not yet implemented in ssldump", ex); + explain(ssl, "Extension type: %u not yet implemented in ssldump,\n", ex); } continue; } @@ -2538,7 +2538,7 @@ static int decode_extension_server_name(ssl,dir,seg,data) if (ssl_decode_switch(ssl,server_name_type_decoder,t,dir,seg,data) == R_NOT_FOUND) { decode_server_name(ssl,dir,seg,data); P_(P_RH){ - explain(ssl, "Server Name type: %s not yet implemented in ssldump", t); + explain(ssl, "Server Name type: %u not yet implemented in ssldump\n", t); } continue; }