Skip to content

Commit d839e5d

Browse files
committed
IPv6 mobility: Print the message name before the check on it
Print a more precise error message about the message header length. This is an invalid case, not a truncation case. Before: (header length 8 is too small for type 6) [|mobility] After: BA (header length 8 < 12) (invalid)
1 parent 65403c7 commit d839e5d

File tree

2 files changed

+8
-4
lines changed

2 files changed

+8
-4
lines changed

print-mobility.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -221,11 +221,11 @@ mobility_print(netdissect_options *ndo,
221221
/* XXX ip6m_cksum */
222222

223223
type = GET_U_1(mh->ip6m_type);
224+
ND_PRINT("%s", tok2str(ip6m_str, "type-#%u", type));
224225
if (type <= IP6M_MAX && mhlen < ip6m_hdrlen[type]) {
225-
ND_PRINT("(header length %u is too small for type %u)", mhlen, type);
226-
goto trunc;
226+
ND_PRINT(" (header length %u < %u)", mhlen, ip6m_hdrlen[type]);
227+
goto invalid;
227228
}
228-
ND_PRINT("%s", tok2str(ip6m_str, "type-#%u", type));
229229
switch (type) {
230230
case IP6M_BINDING_REQUEST:
231231
hlen = IP6M_MINLEN;
@@ -314,4 +314,8 @@ mobility_print(netdissect_options *ndo,
314314
trunc:
315315
nd_print_trunc(ndo);
316316
return(-1);
317+
318+
invalid:
319+
nd_print_invalid(ndo);
320+
return(-1);
317321
}

tests/cve2015-0261-ipv6.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
1 2002-12-31 13:55:31.300000 IP6 [header+payload length 26510 > length 185] (invalid) (class 0x76, flowlabel 0x76767, hlim 103, next-header Mobility (135), payload length 26470) 6767:6767:6767:6767:6767:6767:6767:6767 > 6767:6767:6767:6767:6767:6767:6767:6705: mobility: (payload protocol 255 should be 59) BU seq#=26471 HL lifetime=105884(type-0x67: len=103) [|mobility]
2-
2 2003-03-06 15:21:11.300000 IP6 [header+payload length 26510 > length 185] (invalid) (class 0x76, flowlabel 0x76767, hlim 103, next-header Mobility (135), payload length 26470) 6767:6767:6767:6767:6767:6767:6767:6767 > 6767:6767:4f67:6767:6767:6767:6767:6767: mobility: (payload protocol 0 should be 59) (header length 8 is too small for type 6) [|mobility]
2+
2 2003-03-06 15:21:11.300000 IP6 [header+payload length 26510 > length 185] (invalid) (class 0x76, flowlabel 0x76767, hlim 103, next-header Mobility (135), payload length 26470) 6767:6767:6767:6767:6767:6767:6767:6767 > 6767:6767:4f67:6767:6767:6767:6767:6767: mobility: (payload protocol 0 should be 59) BA (header length 8 < 12) (invalid)

0 commit comments

Comments
 (0)