Add boundary checks to prevent out-of-bounds access in BgpLayer::getHeaderLen()

Author: danasana

Packet++/src/Layer.cpp

@@ -78,6 +78,25 @@ namespace pcpp
 			return true;
 		}
 
+		if ((size_t)offsetInLayer > m_DataLen)
+		{
+			PCPP_LOG_ERROR("Requested offset is larger than data length");
+			return false;
+		}
+
+		if (m_Data - m_Packet->m_RawPacket->getRawData() + (ptrdiff_t)offsetInLayer 
+			> (ptrdiff_t)m_Packet->m_RawPacket->getRawDataLen())
+		{
+			PCPP_LOG_ERROR("Requested offset is larger than total packet length");
+			return false;
+		}
+
+		if (m_NextLayer != nullptr && (ptrdiff_t)offsetInLayer > m_NextLayer->m_Data - m_Data)
+		{
+			PCPP_LOG_ERROR("Requested offset exceeds current layer's boundary");
+			return false;
+		}
+
 		return m_Packet->extendLayer(this, offsetInLayer, numOfBytesToExtend);
 	}
 
@@ -107,6 +126,32 @@ namespace pcpp
 			return true;
 		}
 
+		if ((size_t)offsetInLayer >= m_DataLen)
+		{
+			PCPP_LOG_ERROR("Requested offset is larger than data length");
+			return false;
+		}
+
+		if ((size_t)offsetInLayer + numOfBytesToShorten > m_DataLen)
+		{
+			PCPP_LOG_ERROR("Requested number of bytes to shorten is larger than data length");
+			return false;
+		}
+
+		if (m_Data - m_Packet->m_RawPacket->getRawData() + (ptrdiff_t)offsetInLayer + (ptrdiff_t)numOfBytesToShorten
+			> (ptrdiff_t)(m_Packet->m_RawPacket->getRawDataLen()))
+		{
+			PCPP_LOG_ERROR("Requested number of bytes to shorten is larger than total packet length");
+			return false;
+		}
+
+		if (m_NextLayer != nullptr && (ptrdiff_t)offsetInLayer + (ptrdiff_t)numOfBytesToShorten 
+			> m_NextLayer->m_Data - m_Data)
+		{
+			PCPP_LOG_ERROR("Requested number of bytes to shorten exceeds current layer's boundary");
+			return false;
+		}
+
 		return m_Packet->shortenLayer(this, offsetInLayer, numOfBytesToShorten);
 	}
 

Packet++/src/Packet.cpp

@@ -619,6 +619,8 @@ namespace pcpp
 			// assuming header length of the layer that requested to be extended hasn't been enlarged yet
 			size_t headerLen = curLayer->getHeaderLen() + (curLayer == layer ? numOfBytesToExtend : 0);
 			dataPtr += headerLen;
+			if (dataPtr > m_RawPacket->getRawData() + m_RawPacket->getRawDataLen())
+				break;
 			curLayer = curLayer->getNextLayer();
 		}
 
@@ -671,6 +673,8 @@ namespace pcpp
 			// assuming header length of the layer that requested to be extended hasn't been enlarged yet
 			size_t headerLen = curLayer->getHeaderLen() - (curLayer == layer ? numOfBytesToShorten : 0);
 			dataPtr += headerLen;
+			if (dataPtr > m_RawPacket->getRawData() + m_RawPacket->getRawDataLen())
+				break;
 			curLayer = curLayer->getNextLayer();
 		}