diff --git a/Packet++/src/Layer.cpp b/Packet++/src/Layer.cpp index ced53ab4ba..ec0e80079f 100644 --- a/Packet++/src/Layer.cpp +++ b/Packet++/src/Layer.cpp @@ -61,14 +61,20 @@ namespace pcpp return false; } - if (m_Packet == nullptr) + if (offsetInLayer < 0) + { + PCPP_LOG_ERROR("Requested offset is negative"); + return false; + } + + if (static_cast(offsetInLayer) > m_DataLen) { - if ((size_t)offsetInLayer > m_DataLen) - { - PCPP_LOG_ERROR("Requested offset is larger than data length"); - return false; - } + PCPP_LOG_ERROR("Requested offset is larger than data length"); + return false; + } + if (m_Packet == nullptr) + { uint8_t* newData = new uint8_t[m_DataLen + numOfBytesToExtend]; memcpy(newData, m_Data, offsetInLayer); memcpy(newData + offsetInLayer + numOfBytesToExtend, m_Data + offsetInLayer, m_DataLen - offsetInLayer); @@ -78,6 +84,19 @@ namespace pcpp return true; } + if (m_Data - m_Packet->m_RawPacket->getRawData() + static_cast(offsetInLayer) > + static_cast(m_Packet->m_RawPacket->getRawDataLen())) + { + PCPP_LOG_ERROR("Requested offset is larger than total packet length"); + return false; + } + + if (m_NextLayer != nullptr && static_cast(offsetInLayer) > m_NextLayer->m_Data - m_Data) + { + PCPP_LOG_ERROR("Requested offset exceeds current layer's boundary"); + return false; + } + return m_Packet->extendLayer(this, offsetInLayer, numOfBytesToExtend); } @@ -89,14 +108,20 @@ namespace pcpp return false; } - if (m_Packet == nullptr) + if (offsetInLayer < 0) + { + PCPP_LOG_ERROR("Requested offset is negative"); + return false; + } + + if (static_cast(offsetInLayer) >= m_DataLen) { - if ((size_t)offsetInLayer >= m_DataLen) - { - PCPP_LOG_ERROR("Requested offset is larger than data length"); - return false; - } + PCPP_LOG_ERROR("Requested offset is larger than data length"); + return false; + } + if (m_Packet == nullptr) + { uint8_t* newData = new uint8_t[m_DataLen - numOfBytesToShorten]; memcpy(newData, m_Data, offsetInLayer); memcpy(newData + offsetInLayer, m_Data + offsetInLayer + numOfBytesToShorten, @@ -107,6 +132,28 @@ namespace pcpp return true; } + if (static_cast(offsetInLayer) + numOfBytesToShorten > m_DataLen) + { + PCPP_LOG_ERROR("Requested number of bytes to shorten is larger than data length"); + return false; + } + + if (m_Data - m_Packet->m_RawPacket->getRawData() + static_cast(offsetInLayer) + + static_cast(numOfBytesToShorten) > + static_cast(m_Packet->m_RawPacket->getRawDataLen())) + { + PCPP_LOG_ERROR("Requested number of bytes to shorten is larger than total packet length"); + return false; + } + + if (m_NextLayer != nullptr && + static_cast(offsetInLayer) + static_cast(numOfBytesToShorten) > + m_NextLayer->m_Data - m_Data) + { + PCPP_LOG_ERROR("Requested number of bytes to shorten exceeds current layer's boundary"); + return false; + } + return m_Packet->shortenLayer(this, offsetInLayer, numOfBytesToShorten); } diff --git a/Packet++/src/Packet.cpp b/Packet++/src/Packet.cpp index 4ff44a2ba6..57fe6ed0af 100644 --- a/Packet++/src/Packet.cpp +++ b/Packet++/src/Packet.cpp @@ -609,6 +609,9 @@ namespace pcpp // assuming header length of the layer that requested to be extended hasn't been enlarged yet size_t headerLen = curLayer->getHeaderLen() + (curLayer == layer ? numOfBytesToExtend : 0); dataPtr += headerLen; + + if (dataPtr > m_RawPacket->getRawData() + m_RawPacket->getRawDataLen()) + break; } return true; @@ -660,6 +663,8 @@ namespace pcpp // assuming header length of the layer that requested to be extended hasn't been enlarged yet size_t headerLen = curLayer->getHeaderLen() - (curLayer == layer ? numOfBytesToShorten : 0); dataPtr += headerLen; + if (dataPtr > m_RawPacket->getRawData() + m_RawPacket->getRawDataLen()) + break; curLayer = curLayer->getNextLayer(); } diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/047c56c3504ad04232497c903af06c0bc4b5c6f73927ad07cde79cfa28d94f8b b/Tests/Fuzzers/RegressionTests/regression_samples/047c56c3504ad04232497c903af06c0bc4b5c6f73927ad07cde79cfa28d94f8b new file mode 100644 index 0000000000..847818881e Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/047c56c3504ad04232497c903af06c0bc4b5c6f73927ad07cde79cfa28d94f8b differ diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/1eb005b8d62599b6561acf7e778f51603ccbc5ddf948c0b081617668bb56cee4 b/Tests/Fuzzers/RegressionTests/regression_samples/1eb005b8d62599b6561acf7e778f51603ccbc5ddf948c0b081617668bb56cee4 new file mode 100644 index 0000000000..56d868d1da Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/1eb005b8d62599b6561acf7e778f51603ccbc5ddf948c0b081617668bb56cee4 differ diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/39d92632b6a92f1c682c052febfbc74b0561536687be3b7ce7b9508e8b9726d6 b/Tests/Fuzzers/RegressionTests/regression_samples/39d92632b6a92f1c682c052febfbc74b0561536687be3b7ce7b9508e8b9726d6 new file mode 100644 index 0000000000..27eda11ae5 Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/39d92632b6a92f1c682c052febfbc74b0561536687be3b7ce7b9508e8b9726d6 differ diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/6f6fd63a9a6d8dd1a206eff00c915ed4b643034dad7e9986fd89a43244d6be97 b/Tests/Fuzzers/RegressionTests/regression_samples/6f6fd63a9a6d8dd1a206eff00c915ed4b643034dad7e9986fd89a43244d6be97 new file mode 100644 index 0000000000..b441d60d58 Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/6f6fd63a9a6d8dd1a206eff00c915ed4b643034dad7e9986fd89a43244d6be97 differ diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/6fda21d7ebaa0391434f17eecf25b1d7c58633f96b6906183c626cbdfc35b325 b/Tests/Fuzzers/RegressionTests/regression_samples/6fda21d7ebaa0391434f17eecf25b1d7c58633f96b6906183c626cbdfc35b325 new file mode 100644 index 0000000000..5386b26243 Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/6fda21d7ebaa0391434f17eecf25b1d7c58633f96b6906183c626cbdfc35b325 differ diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/a7a658b6e51576eafe7990dbc35c5bfff991d914c9ead914e26e3bfc3e88221c b/Tests/Fuzzers/RegressionTests/regression_samples/a7a658b6e51576eafe7990dbc35c5bfff991d914c9ead914e26e3bfc3e88221c new file mode 100644 index 0000000000..9cb865d467 Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/a7a658b6e51576eafe7990dbc35c5bfff991d914c9ead914e26e3bfc3e88221c differ diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/adb739b5829aacedbec6cf3969413997d23b6f2e3350ddf0b1cc3b4d1c335a95 b/Tests/Fuzzers/RegressionTests/regression_samples/adb739b5829aacedbec6cf3969413997d23b6f2e3350ddf0b1cc3b4d1c335a95 new file mode 100644 index 0000000000..b181304e86 Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/adb739b5829aacedbec6cf3969413997d23b6f2e3350ddf0b1cc3b4d1c335a95 differ diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/e0c0f8fea6e931d9671384a66f4e1ab02d84e27a5f091e9c7b1fce89d9c18837 b/Tests/Fuzzers/RegressionTests/regression_samples/e0c0f8fea6e931d9671384a66f4e1ab02d84e27a5f091e9c7b1fce89d9c18837 new file mode 100644 index 0000000000..eb6c488d74 Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/e0c0f8fea6e931d9671384a66f4e1ab02d84e27a5f091e9c7b1fce89d9c18837 differ diff --git a/Tests/Fuzzers/RegressionTests/regression_samples/ec4b17a4e7b994548f03ae05d8d8924a515a236892959f3300e1c9e8a9c56ba7 b/Tests/Fuzzers/RegressionTests/regression_samples/ec4b17a4e7b994548f03ae05d8d8924a515a236892959f3300e1c9e8a9c56ba7 new file mode 100644 index 0000000000..3af4bececc Binary files /dev/null and b/Tests/Fuzzers/RegressionTests/regression_samples/ec4b17a4e7b994548f03ae05d8d8924a515a236892959f3300e1c9e8a9c56ba7 differ