Skip to content

Commit 646610c

Browse files
committed
Move headerLen calculation and dataPtr bounds check
- Calculate headerLen before updating m_DataLen to avoid double subtraction - Move dataPtr validation to beginning of loop and add log message
1 parent b5203a3 commit 646610c

File tree

1 file changed

+16
-3
lines changed

1 file changed

+16
-3
lines changed

Packet++/src/Packet.cpp

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -605,6 +605,12 @@ namespace pcpp
605605
bool passedExtendedLayer = false;
606606
for (Layer* curLayer = m_FirstLayer; curLayer != nullptr; curLayer = curLayer->getNextLayer())
607607
{
608+
if (dataPtr > m_RawPacket->getRawData() + m_RawPacket->getRawDataLen())
609+
{
610+
PCPP_LOG_ERROR("Layer data pointer exceeds packet's boundary");
611+
return false;
612+
}
613+
608614
// set the data ptr
609615
curLayer->m_Data = const_cast<uint8_t*>(dataPtr);
610616

@@ -656,23 +662,30 @@ namespace pcpp
656662
bool passedExtendedLayer = false;
657663
while (curLayer != nullptr)
658664
{
665+
if (dataPtr > m_RawPacket->getRawData() + m_RawPacket->getRawDataLen())
666+
{
667+
PCPP_LOG_ERROR("Layer data pointer exceeds packet's boundary");
668+
return false;
669+
}
670+
659671
// set the data ptr
660672
curLayer->m_Data = const_cast<uint8_t*>(dataPtr);
661673

662674
// set a flag if arrived to the layer being shortened
663675
if (curLayer->getPrevLayer() == layer)
664676
passedExtendedLayer = true;
665677

678+
size_t headerLen = curLayer->getHeaderLen();
679+
666680
// change the data length only for layers who come before the shortened layer. For layers who come after,
667681
// data length isn't changed
668682
if (!passedExtendedLayer)
669683
curLayer->m_DataLen -= numOfBytesToShorten;
670684

671685
// assuming header length of the layer that requested to be extended hasn't been enlarged yet
672-
size_t headerLen = curLayer->getHeaderLen() - (curLayer == layer ? numOfBytesToShorten : 0);
686+
// size_t headerLen = curLayer->getHeaderLen() - (curLayer == layer ? numOfBytesToShorten : 0);
687+
headerLen -= (curLayer == layer ? numOfBytesToShorten : 0);
673688
dataPtr += headerLen;
674-
if (dataPtr > m_RawPacket->getRawData() + m_RawPacket->getRawDataLen())
675-
break;
676689
curLayer = curLayer->getNextLayer();
677690
}
678691

0 commit comments

Comments
 (0)