Skip to content

Commit dc1b49b

Browse files
committed
Fix two undefined behaviors for the pcap_loop() call
Limit the --skip argument to INT_MAX. Limit the sum of -c and --skip arguments to INT_MAX. Fix the regression in 3eab64d: The '--skip 0' option is allowed to get the first packet in some loop e.g. in a shell script. The errors were: tcpdump.c:2696:8: runtime error: implicit conversion from type 'int' of value -1 (32-bit, signed) to type 'u_int' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior tcpdump.c:2696:8 tcpdump.c:2696:8: runtime error: implicit conversion from type 'u_int' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'int' changed the value to -1 (32-bit, signed) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior tcpdump.c:2696:8
1 parent 7b422ef commit dc1b49b

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

tcpdump.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2056,7 +2056,7 @@ main(int argc, char **argv)
20562056

20572057
case OPTION_SKIP:
20582058
packets_skipped = parse_u_int("packet skip count",
2059-
optarg, NULL, 1, UINT_MAX, 0);
2059+
optarg, NULL, 0, INT_MAX, 0);
20602060
break;
20612061

20622062
#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
@@ -2097,6 +2097,12 @@ main(int argc, char **argv)
20972097
if (ndo->ndo_xflag && ndo->ndo_Xflag)
20982098
warning("-x[x] and -X[X] are mutually exclusive. -x[x] ignored.");
20992099

2100+
if (cnt != -1)
2101+
if ((int)packets_skipped > (INT_MAX - cnt))
2102+
// cnt + (int)packets_skipped used in pcap_loop() call
2103+
error("Overflow (-c count) %d + (--skip count) %d", cnt,
2104+
(int)packets_skipped);
2105+
21002106
if (Dflag)
21012107
show_devices_and_exit();
21022108
#ifdef HAVE_PCAP_FINDALLDEVS_EX
@@ -2693,7 +2699,7 @@ DIAG_ON_ASSIGN_ENUM
26932699

26942700
do {
26952701
status = pcap_loop(pd,
2696-
cnt + (cnt == -1 ? 0 : packets_skipped),
2702+
(cnt == -1 ? -1 : cnt + (int)packets_skipped),
26972703
callback, pcap_userdata);
26982704
if (WFileName == NULL) {
26992705
/*

0 commit comments

Comments
 (0)