Skip to content

Commit 5fefba1

Browse files
committed
ICMP: Fix an undefined behavior for the Interface Name Sub-Object
Add a test for the Interface Name Sub-Object length == 0. If inft_name_length_field == 0, nd_printjnp() was called with inft_name_length_field - 1 == -1. Add a test file. The error was: print-icmp.c:893:37: runtime error: implicit conversion from type 'int' of value -1 (32-bit, signed) to type 'u_int' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior print-icmp.c:893:37
1 parent cbcd977 commit 5fefba1

File tree

4 files changed

+14
-0
lines changed

4 files changed

+14
-0
lines changed

print-icmp.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -876,6 +876,11 @@ icmp_print(netdissect_options *ndo, const u_char *bp, u_int plen, const u_char *
876876
ifname_subobj = (const struct icmp_interface_identification_ifname_subobject_t *) offset;
877877
inft_name_length_field = GET_U_1(ifname_subobj->length);
878878
ND_PRINT("\n\t\t Interface Name");
879+
if (inft_name_length_field == 0) {
880+
ND_PRINT(" [length %u]", inft_name_length_field);
881+
nd_print_invalid(ndo);
882+
break;
883+
}
879884
if (inft_name_length_field % 4 != 0) {
880885
ND_PRINT(" [length %u != N x 4]", inft_name_length_field);
881886
nd_print_invalid(ndo);

tests/TESTLIST

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,7 @@ dvmrp mrinfo_query.pcap dvmrp.out
215215

216216
# ICMPv4 -- pcap from https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6632
217217
rfc5837 icmp-rfc5837.pcap icmp-rfc5837.out -v
218+
icmp_inft_name_length_zero icmp_inft_name_length_zero.pcap icmp_inft_name_length_zero.out -v
218219

219220
# ICMPv6
220221
icmpv6 icmpv6.pcap icmpv6.out -vv

tests/icmp_inft_name_length_zero.out

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
1 10:13:29.4294643617 IP [total length 33008 > length 240] (invalid) (tos 0x0, ttl 254, id 59168, offset 0, flags [DF], proto ICMP (1), length 33008, bad cksum 7ade (->464)!)
2+
0.128.255.255 > 12.4.4.4: ICMP time exceeded in-transit, length 32988
3+
IP (tos 0x0, ttl 1, id 42321, offset 0, flags [none], proto UDP (17), length 40, bad cksum f76a (->db81)!)
4+
8.15.4.4.42315 > 12.223.32.1.33440: UDP, length 12
5+
ICMP Multi-Part extension v2
6+
Interface Identification Object (2), Class-Type: 2, length 8016
7+
This object describes the IP interface upon which a datagram arrived
8+
Interface Name [length 0] (invalid) [|icmp]

tests/icmp_inft_name_length_zero.pcap

211 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)