You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
gentoo-overlay/net-analyzer/tcpdump/files/tcpdump-4.6.2-CVE-2014-8768...

328 lines
8.1 KiB

--- a/print-geonet.c
+++ b/print-geonet.c
@@ -56,16 +56,12 @@ static const struct tok msg_type_values[] = {
static void
print_btp_body(netdissect_options *ndo,
- const u_char *bp, u_int length)
+ const u_char *bp)
{
int version;
int msg_type;
const char *msg_type_str;
- if (length <= 2) {
- return;
- }
-
/* Assuming ItsDpuHeader */
version = bp[0];
msg_type = bp[1];
@@ -83,7 +79,7 @@ print_btp(netdissect_options *ndo,
ND_PRINT((ndo, "; BTP Dst:%u Src:%u", dest, src));
}
-static void
+static int
print_long_pos_vector(netdissect_options *ndo,
const u_char *bp)
{
@@ -91,10 +87,13 @@ print_long_pos_vector(netdissect_options *ndo,
ND_PRINT((ndo, "GN_ADDR:%s ", linkaddr_string (ndo, bp, 0, GEONET_ADDR_LEN)));
+ if (!ND_TTEST2(*(bp+12), 8))
+ return (-1);
lat = EXTRACT_32BITS(bp+12);
ND_PRINT((ndo, "lat:%d ", lat));
lon = EXTRACT_32BITS(bp+16);
ND_PRINT((ndo, "lon:%d", lon));
+ return (0);
}
@@ -105,137 +104,170 @@ print_long_pos_vector(netdissect_options *ndo,
void
geonet_print(netdissect_options *ndo, const u_char *eth, const u_char *bp, u_int length)
{
+ int version;
+ int next_hdr;
+ int hdr_type;
+ int hdr_subtype;
+ uint16_t payload_length;
+ int hop_limit;
+ const char *next_hdr_txt = "Unknown";
+ const char *hdr_type_txt = "Unknown";
+ int hdr_size = -1;
+
ND_PRINT((ndo, "GeoNet src:%s; ", etheraddr_string(ndo, eth+6)));
- if (length >= 36) {
- /* Process Common Header */
- int version = bp[0] >> 4;
- int next_hdr = bp[0] & 0x0f;
- int hdr_type = bp[1] >> 4;
- int hdr_subtype = bp[1] & 0x0f;
- uint16_t payload_length = EXTRACT_16BITS(bp+4);
- int hop_limit = bp[7];
- const char *next_hdr_txt = "Unknown";
- const char *hdr_type_txt = "Unknown";
- int hdr_size = -1;
+ /* Process Common Header */
+ if (length < 36)
+ goto malformed;
+
+ ND_TCHECK2(*bp, 7);
+ version = bp[0] >> 4;
+ next_hdr = bp[0] & 0x0f;
+ hdr_type = bp[1] >> 4;
+ hdr_subtype = bp[1] & 0x0f;
+ payload_length = EXTRACT_16BITS(bp+4);
+ hop_limit = bp[7];
- switch (next_hdr) {
- case 0: next_hdr_txt = "Any"; break;
- case 1: next_hdr_txt = "BTP-A"; break;
- case 2: next_hdr_txt = "BTP-B"; break;
- case 3: next_hdr_txt = "IPv6"; break;
- }
+ switch (next_hdr) {
+ case 0: next_hdr_txt = "Any"; break;
+ case 1: next_hdr_txt = "BTP-A"; break;
+ case 2: next_hdr_txt = "BTP-B"; break;
+ case 3: next_hdr_txt = "IPv6"; break;
+ }
- switch (hdr_type) {
- case 0: hdr_type_txt = "Any"; break;
- case 1: hdr_type_txt = "Beacon"; break;
- case 2: hdr_type_txt = "GeoUnicast"; break;
- case 3: switch (hdr_subtype) {
- case 0: hdr_type_txt = "GeoAnycastCircle"; break;
- case 1: hdr_type_txt = "GeoAnycastRect"; break;
- case 2: hdr_type_txt = "GeoAnycastElipse"; break;
- }
- break;
- case 4: switch (hdr_subtype) {
- case 0: hdr_type_txt = "GeoBroadcastCircle"; break;
- case 1: hdr_type_txt = "GeoBroadcastRect"; break;
- case 2: hdr_type_txt = "GeoBroadcastElipse"; break;
- }
- break;
- case 5: switch (hdr_subtype) {
- case 0: hdr_type_txt = "TopoScopeBcast-SH"; break;
- case 1: hdr_type_txt = "TopoScopeBcast-MH"; break;
- }
- break;
- case 6: switch (hdr_subtype) {
- case 0: hdr_type_txt = "LocService-Request"; break;
- case 1: hdr_type_txt = "LocService-Reply"; break;
- }
- break;
- }
+ switch (hdr_type) {
+ case 0: hdr_type_txt = "Any"; break;
+ case 1: hdr_type_txt = "Beacon"; break;
+ case 2: hdr_type_txt = "GeoUnicast"; break;
+ case 3: switch (hdr_subtype) {
+ case 0: hdr_type_txt = "GeoAnycastCircle"; break;
+ case 1: hdr_type_txt = "GeoAnycastRect"; break;
+ case 2: hdr_type_txt = "GeoAnycastElipse"; break;
+ }
+ break;
+ case 4: switch (hdr_subtype) {
+ case 0: hdr_type_txt = "GeoBroadcastCircle"; break;
+ case 1: hdr_type_txt = "GeoBroadcastRect"; break;
+ case 2: hdr_type_txt = "GeoBroadcastElipse"; break;
+ }
+ break;
+ case 5: switch (hdr_subtype) {
+ case 0: hdr_type_txt = "TopoScopeBcast-SH"; break;
+ case 1: hdr_type_txt = "TopoScopeBcast-MH"; break;
+ }
+ break;
+ case 6: switch (hdr_subtype) {
+ case 0: hdr_type_txt = "LocService-Request"; break;
+ case 1: hdr_type_txt = "LocService-Reply"; break;
+ }
+ break;
+ }
+
+ ND_PRINT((ndo, "v:%d ", version));
+ ND_PRINT((ndo, "NH:%d-%s ", next_hdr, next_hdr_txt));
+ ND_PRINT((ndo, "HT:%d-%d-%s ", hdr_type, hdr_subtype, hdr_type_txt));
+ ND_PRINT((ndo, "HopLim:%d ", hop_limit));
+ ND_PRINT((ndo, "Payload:%d ", payload_length));
+ if (print_long_pos_vector(ndo, bp + 8) == -1)
+ goto trunc;
- ND_PRINT((ndo, "v:%d ", version));
- ND_PRINT((ndo, "NH:%d-%s ", next_hdr, next_hdr_txt));
- ND_PRINT((ndo, "HT:%d-%d-%s ", hdr_type, hdr_subtype, hdr_type_txt));
- ND_PRINT((ndo, "HopLim:%d ", hop_limit));
- ND_PRINT((ndo, "Payload:%d ", payload_length));
- print_long_pos_vector(ndo, bp + 8);
+ /* Skip Common Header */
+ length -= 36;
+ bp += 36;
- /* Skip Common Header */
- length -= 36;
- bp += 36;
+ /* Process Extended Headers */
+ switch (hdr_type) {
+ case 0: /* Any */
+ hdr_size = 0;
+ break;
+ case 1: /* Beacon */
+ hdr_size = 0;
+ break;
+ case 2: /* GeoUnicast */
+ break;
+ case 3: switch (hdr_subtype) {
+ case 0: /* GeoAnycastCircle */
+ break;
+ case 1: /* GeoAnycastRect */
+ break;
+ case 2: /* GeoAnycastElipse */
+ break;
+ }
+ break;
+ case 4: switch (hdr_subtype) {
+ case 0: /* GeoBroadcastCircle */
+ break;
+ case 1: /* GeoBroadcastRect */
+ break;
+ case 2: /* GeoBroadcastElipse */
+ break;
+ }
+ break;
+ case 5: switch (hdr_subtype) {
+ case 0: /* TopoScopeBcast-SH */
+ hdr_size = 0;
+ break;
+ case 1: /* TopoScopeBcast-MH */
+ hdr_size = 68 - 36;
+ break;
+ }
+ break;
+ case 6: switch (hdr_subtype) {
+ case 0: /* LocService-Request */
+ break;
+ case 1: /* LocService-Reply */
+ break;
+ }
+ break;
+ }
- /* Process Extended Headers */
- switch (hdr_type) {
+ /* Skip Extended headers */
+ if (hdr_size >= 0) {
+ if (length < (u_int)hdr_size)
+ goto malformed;
+ ND_TCHECK2(*bp, hdr_size);
+ length -= hdr_size;
+ bp += hdr_size;
+ switch (next_hdr) {
case 0: /* Any */
- hdr_size = 0;
- break;
- case 1: /* Beacon */
- hdr_size = 0;
- break;
- case 2: /* GeoUnicast */
break;
- case 3: switch (hdr_subtype) {
- case 0: /* GeoAnycastCircle */
- break;
- case 1: /* GeoAnycastRect */
- break;
- case 2: /* GeoAnycastElipse */
- break;
+ case 1:
+ case 2: /* BTP A/B */
+ if (length < 4)
+ goto malformed;
+ ND_TCHECK2(*bp, 4);
+ print_btp(ndo, bp);
+ length -= 4;
+ bp += 4;
+ if (length >= 2) {
+ /*
+ * XXX - did print_btp_body()
+ * return if length < 2
+ * because this is optional,
+ * or was that just not
+ * reporting genuine errors?
+ */
+ ND_TCHECK2(*bp, 2);
+ print_btp_body(ndo, bp);
}
break;
- case 4: switch (hdr_subtype) {
- case 0: /* GeoBroadcastCircle */
- break;
- case 1: /* GeoBroadcastRect */
- break;
- case 2: /* GeoBroadcastElipse */
- break;
- }
- break;
- case 5: switch (hdr_subtype) {
- case 0: /* TopoScopeBcast-SH */
- hdr_size = 0;
- break;
- case 1: /* TopoScopeBcast-MH */
- hdr_size = 68 - 36;
- break;
- }
- break;
- case 6: switch (hdr_subtype) {
- case 0: /* LocService-Request */
- break;
- case 1: /* LocService-Reply */
- break;
- }
+ case 3: /* IPv6 */
break;
}
-
- /* Skip Extended headers */
- if (hdr_size >= 0) {
- length -= hdr_size;
- bp += hdr_size;
- switch (next_hdr) {
- case 0: /* Any */
- break;
- case 1:
- case 2: /* BTP A/B */
- print_btp(ndo, bp);
- length -= 4;
- bp += 4;
- print_btp_body(ndo, bp, length);
- break;
- case 3: /* IPv6 */
- break;
- }
- }
- } else {
- ND_PRINT((ndo, "Malformed (small) "));
}
/* Print user data part */
if (ndo->ndo_vflag)
ND_DEFAULTPRINT(bp, length);
+ return;
+
+malformed:
+ ND_PRINT((ndo, " Malformed (small) "));
+ /* XXX - print the remaining data as hex? */
+ return;
+
+trunc:
+ ND_PRINT((ndo, "[|geonet]"));
}