parse_eth_hdr() is assuming that every ETH_P_BATMAN ethernet packet has a
valid, minimal batman-adv header (packet_type, version, ttl) attached. But
it doesn't actually check if the received buffer has enough bytes to access
the two bytes packet_type + version. So it is possible that it tries to
read outside of the received data.
Fixes: 3bdfc388e74b ("implement simple tcpdump, first only batman packets")
Signed-off-by: Sven Eckelmann <s...@narfation.org>
---
tcpdump.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tcpdump.c b/tcpdump.c
index d340af9..d15c32e 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -1167,6 +1167,9 @@ static void parse_eth_hdr(unsigned char *packet_buff,
ssize_t buff_len, int read
dump_vlan(packet_buff, buff_len, read_opt,
time_printed);
break;
case ETH_P_BATMAN:
+ /* check for batman-adv packet_type + version */
+ LEN_CHECK(buff_len, sizeof(*eth_hdr) + 2, "BAT HEADER")
+
batman_ogm_packet = (struct batadv_ogm_packet *)(packet_buff +
ETH_HLEN);
if ((read_opt & COMPAT_FILTER) &&
--
2.39.2
