Module: monitoring-plugins
 Branch: master
 Commit: f732906649f8b6a5ee5636ece10d19e4519b790b
 Author: Holger Weiss <[email protected]>
   Date: Tue Jun 30 16:20:12 2026 +0200
    URL: 
https://www.monitoring-plugins.org/repositories/monitoring-plugins/commit/?id=f7329066

check_icmp: Reject negative ICMP data length

The -b/--size handler checks the lower bound after casting the value to
unsigned long while checking the upper bound as a signed comparison.  A
negative argument such as "-b -65536" therefore satisfies both checks.
The value is then truncated to an undersized icmp_data_size, which later
serves as the size of the ICMP send buffer, so building the packet
overflows that buffer.

Compare the size as a signed long against both bounds so negative values
are rejected.

Reported-by: Christopher Kreft <[email protected]>

---

 plugins-root/check_icmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
index 8f5c1fe4..14e63c89 100644
--- a/plugins-root/check_icmp.c
+++ b/plugins-root/check_icmp.c
@@ -411,7 +411,7 @@ check_icmp_config_wrapper process_arguments(int argc, char 
**argv) {
                        switch (arg) {
                        case 'b': {
                                long size = strtol(optarg, NULL, 0);
-                               if ((unsigned long)size >= (sizeof(struct icmp) 
+ sizeof(struct icmp_ping_data)) &&
+                               if (size >= (long)(sizeof(struct icmp) + 
sizeof(struct icmp_ping_data)) &&
                                        size < MAX_PING_DATA) {
                                        result.config.icmp_data_size = 
(unsigned short)size;
                                } else {

Reply via email to