|
@@ -1,61 +0,0 @@
|
|
|
-From c45443a0d3e16b92622bea6b589e5930e8f0d815 Mon Sep 17 00:00:00 2001
|
|
|
-From: Peiran Hong <peiran.hong@windriver.com>
|
|
|
-Date: Fri, 13 Sep 2019 17:02:57 -0400
|
|
|
-Subject: [PATCH] CVE-2017-16808/AoE: Add a missing bounds check.
|
|
|
-
|
|
|
----
|
|
|
- netdissect.h | 12 ++++++++++++
|
|
|
- print-aoe.c | 1 +
|
|
|
- 2 files changed, 13 insertions(+)
|
|
|
-
|
|
|
-diff --git a/netdissect.h b/netdissect.h
|
|
|
-index 089b0406..cd05fdb9 100644
|
|
|
---- a/netdissect.h
|
|
|
-+++ b/netdissect.h
|
|
|
-@@ -69,6 +69,11 @@ typedef struct {
|
|
|
- typedef unsigned char nd_uint8_t;
|
|
|
- typedef signed char nd_int8_t;
|
|
|
-
|
|
|
-+/*
|
|
|
-+ * Use this for MAC addresses.
|
|
|
-+ */
|
|
|
-+#define MAC_ADDR_LEN 6 /* length of MAC addresses */
|
|
|
-+
|
|
|
- /* snprintf et al */
|
|
|
-
|
|
|
- #include <stdarg.h>
|
|
|
-@@ -309,12 +314,19 @@ struct netdissect_options {
|
|
|
- ((uintptr_t)ndo->ndo_snapend - (l) <= (uintptr_t)ndo->ndo_snapend && \
|
|
|
- (uintptr_t)&(var) <= (uintptr_t)ndo->ndo_snapend - (l)))
|
|
|
-
|
|
|
-+#define ND_TTEST_LEN(p, l) \
|
|
|
-+ (IS_NOT_NEGATIVE(l) && \
|
|
|
-+ ((uintptr_t)ndo->ndo_snapend - (l) <= (uintptr_t)ndo->ndo_snapend && \
|
|
|
-+ (uintptr_t)(p) <= (uintptr_t)ndo->ndo_snapend - (l)))
|
|
|
-+
|
|
|
- /* True if "var" was captured */
|
|
|
- #define ND_TTEST(var) ND_TTEST2(var, sizeof(var))
|
|
|
-
|
|
|
- /* Bail if "l" bytes of "var" were not captured */
|
|
|
- #define ND_TCHECK2(var, l) if (!ND_TTEST2(var, l)) goto trunc
|
|
|
-
|
|
|
-+#define ND_TCHECK_LEN(p, l) if (!ND_TTEST_LEN(p, l)) goto trunc
|
|
|
-+
|
|
|
- /* Bail if "var" was not captured */
|
|
|
- #define ND_TCHECK(var) ND_TCHECK2(var, sizeof(var))
|
|
|
-
|
|
|
-diff --git a/print-aoe.c b/print-aoe.c
|
|
|
-index 97e93df2..ac097a04 100644
|
|
|
---- a/print-aoe.c
|
|
|
-+++ b/print-aoe.c
|
|
|
-@@ -325,6 +325,7 @@ aoev1_reserve_print(netdissect_options *ndo,
|
|
|
- goto invalid;
|
|
|
- /* addresses */
|
|
|
- for (i = 0; i < nmacs; i++) {
|
|
|
-+ ND_TCHECK_LEN(cp, MAC_ADDR_LEN);
|
|
|
- ND_PRINT((ndo, "\n\tEthernet Address %u: %s", i, etheraddr_string(ndo, cp)));
|
|
|
- cp += ETHER_ADDR_LEN;
|
|
|
- }
|
|
|
---
|
|
|
-2.21.0
|
|
|
-
|