Module: monitoring-plugins Branch: master Commit: f732906649f8b6a5ee5636ece10d19e4519b790b Author: Holger Weiss <[email protected]> Date: Tue Jun 30 16:20:12 2026 +0200 URL: https://www.monitoring-plugins.org/repositories/monitoring-plugins/commit/?id=f7329066
check_icmp: Reject negative ICMP data length The -b/--size handler checks the lower bound after casting the value to unsigned long while checking the upper bound as a signed comparison. A negative argument such as "-b -65536" therefore satisfies both checks. The value is then truncated to an undersized icmp_data_size, which later serves as the size of the ICMP send buffer, so building the packet overflows that buffer. Compare the size as a signed long against both bounds so negative values are rejected. Reported-by: Christopher Kreft <[email protected]> --- plugins-root/check_icmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c index 8f5c1fe4..14e63c89 100644 --- a/plugins-root/check_icmp.c +++ b/plugins-root/check_icmp.c @@ -411,7 +411,7 @@ check_icmp_config_wrapper process_arguments(int argc, char **argv) { switch (arg) { case 'b': { long size = strtol(optarg, NULL, 0); - if ((unsigned long)size >= (sizeof(struct icmp) + sizeof(struct icmp_ping_data)) && + if (size >= (long)(sizeof(struct icmp) + sizeof(struct icmp_ping_data)) && size < MAX_PING_DATA) { result.config.icmp_data_size = (unsigned short)size; } else {
