parse_eth_hdr() reads ether_type without checking that the buffer actually
contains a complete ethernet header. Use an header length check like in all
other functions.

Fixes: 3bdfc388e74b ("implement simple tcpdump, first only batman packets")
Signed-off-by: Sven Eckelmann <[email protected]>
---
 tcpdump.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tcpdump.c b/tcpdump.c
index 33b7226..b6305fd 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -1200,6 +1200,8 @@ static void parse_eth_hdr(unsigned char *packet_buff, 
ssize_t buff_len,
        struct batadv_ogm_packet *batman_ogm_packet;
        struct ether_header *eth_hdr;
 
+       LEN_CHECK(buff_len, sizeof(*eth_hdr), "ETH HEADER");
+
        eth_hdr = (struct ether_header *)packet_buff;
 
        switch (ntohs(eth_hdr->ether_type)) {

-- 
2.47.3

Reply via email to