Fix segfault by OOB read on malformed packets

This commit is contained in:
William Robinet 2020-09-03 19:06:50 +02:00
parent 4a0bbffc92
commit cebce341c5

View file

@ -134,6 +134,12 @@ int network_process_packet(handler,timestamp,data,length)
hlen=p.ip->ip_hl * 4; hlen=p.ip->ip_hl * 4;
p.data += hlen; p.data += hlen;
p.len = ntohs(p.ip->ip_len); p.len = ntohs(p.ip->ip_len);
if(p.len > length) {
printf("Malformed packet, size from IP header is larger than size reported by libpcap, skipping ...\n");
return(0);
}
if (p.len == 0) { if (p.len == 0) {
DBG((0,"ip length reported as 0, presumed to be because of 'TCP segmentation offload' (TSO)\n")); DBG((0,"ip length reported as 0, presumed to be because of 'TCP segmentation offload' (TSO)\n"));
p.len = p._len; p.len = p._len;