You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
67 lines
1.7 KiB
67 lines
1.7 KiB
4 years ago
|
From 907070918d5e81a515315b395f334e52589fe0fb Mon Sep 17 00:00:00 2001
|
||
|
|
From: Guy Harris <guy@alum.mit.edu>
|
||
|
|
Date: Wed, 18 Dec 2019 15:06:53 -0800
|
||
|
|
Subject: [PATCH] Check for invalid IPv4 addresses.
|
||
|
|
|
||
|
|
This should fix GitHub issue #893.
|
||
|
|
---
|
||
|
|
gencode.c | 9 ++++++++-
|
||
|
|
nametoaddr.c | 9 ++++++++-
|
||
|
|
2 files changed, 16 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/gencode.c b/gencode.c
|
||
|
|
index bdc35e646..040a55315 100644
|
||
|
|
--- a/gencode.c
|
||
|
|
+++ b/gencode.c
|
||
|
|
@@ -6947,11 +6947,15 @@ gen_mcode(compiler_state_t *cstate, const char *s1, const char *s2,
|
||
|
|
return (NULL);
|
||
|
|
|
||
|
|
nlen = __pcap_atoin(s1, &n);
|
||
|
|
+ if (nlen < 0)
|
||
|
|
+ bpf_error(cstate, "invalid IPv4 address '%s'", s1);
|
||
|
|
/* Promote short ipaddr */
|
||
|
|
n <<= 32 - nlen;
|
||
|
|
|
||
|
|
if (s2 != NULL) {
|
||
|
|
mlen = __pcap_atoin(s2, &m);
|
||
|
|
+ if (mlen < 0)
|
||
|
|
+ bpf_error(cstate, "invalid IPv4 address '%s'", s2);
|
||
|
|
/* Promote short ipaddr */
|
||
|
|
m <<= 32 - mlen;
|
||
|
|
if ((n & ~m) != 0)
|
||
|
|
@@ -7009,8 +7013,11 @@ gen_ncode(compiler_state_t *cstate, const char *s, bpf_u_int32 v, struct qual q)
|
||
|
|
vlen = __pcap_atodn(s, &v);
|
||
|
|
if (vlen == 0)
|
||
|
|
bpf_error(cstate, "malformed decnet address '%s'", s);
|
||
|
|
- } else
|
||
|
|
+ } else {
|
||
|
|
vlen = __pcap_atoin(s, &v);
|
||
|
|
+ if (vlen < 0)
|
||
|
|
+ bpf_error(cstate, "invalid IPv4 address '%s'", s);
|
||
|
|
+ }
|
||
|
|
|
||
|
|
switch (q.addr) {
|
||
|
|
|
||
|
|
diff --git a/nametoaddr.c b/nametoaddr.c
|
||
|
|
index 53070a285..13bf4c683 100644
|
||
|
|
--- a/nametoaddr.c
|
||
|
|
+++ b/nametoaddr.c
|
||
|
|
@@ -674,8 +674,15 @@ __pcap_atoin(const char *s, bpf_u_int32 *addr)
|
||
|
|
len = 0;
|
||
|
|
for (;;) {
|
||
|
|
n = 0;
|
||
|
|
- while (*s && *s != '.')
|
||
|
|
+ while (*s && *s != '.') {
|
||
|
|
+ if (n > 25) {
|
||
|
|
+ /* The result will be > 255 */
|
||
|
|
+ return -1;
|
||
|
|
+ }
|
||
|
|
n = n * 10 + *s++ - '0';
|
||
|
|
+ }
|
||
|
|
+ if (n > 255)
|
||
|
|
+ return -1;
|
||
|
|
*addr <<= 8;
|
||
|
|
*addr |= n & 0xff;
|
||
|
|
len += 8;
|
||
|
|
|