Module Name: src Committed By: snj Date: Sun Jun 21 21:30:23 UTC 2009
Modified Files: src/dist/tcpdump [netbsd-4]: print-bgp.c print-isoclns.c print-ldp.c print-rsvp.c Log Message: Apply patch (requested by tonnerre in ticket #1329): Fix CAN-2005-1278, CAN-2005-1279 and CAN-2005-1280. To generate a diff of this commit: cvs rdiff -u -r1.5.10.1 -r1.5.10.2 src/dist/tcpdump/print-bgp.c cvs rdiff -u -r1.6.10.1 -r1.6.10.2 src/dist/tcpdump/print-isoclns.c cvs rdiff -u -r1.1.1.1 -r1.1.1.1.10.1 src/dist/tcpdump/print-ldp.c \ src/dist/tcpdump/print-rsvp.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/dist/tcpdump/print-bgp.c diff -u src/dist/tcpdump/print-bgp.c:1.5.10.1 src/dist/tcpdump/print-bgp.c:1.5.10.2 --- src/dist/tcpdump/print-bgp.c:1.5.10.1 Mon Apr 14 21:04:29 2008 +++ src/dist/tcpdump/print-bgp.c Sun Jun 21 21:30:22 2009 @@ -1,4 +1,4 @@ -/* $NetBSD: print-bgp.c,v 1.5.10.1 2008/04/14 21:04:29 jdc Exp $ */ +/* $NetBSD: print-bgp.c,v 1.5.10.2 2009/06/21 21:30:22 snj Exp $ */ /* * Copyright (C) 1999 WIDE Project. @@ -42,7 +42,7 @@ static const char rcsid[] _U_ = "@(#) Header: /tcpdump/master/tcpdump/print-bgp.c,v 1.72.2.4 2004/03/24 00:04:04 guy Exp"; #else -__RCSID("$NetBSD: print-bgp.c,v 1.5.10.1 2008/04/14 21:04:29 jdc Exp $"); +__RCSID("$NetBSD: print-bgp.c,v 1.5.10.2 2009/06/21 21:30:22 snj Exp $"); #endif #endif @@ -1254,6 +1254,8 @@ tptr = pptr + len; break; } + if (advance < 0) /* infinite loop protection */ + break; tptr += advance; } break; @@ -1684,9 +1686,10 @@ while (dat + length > p) { char buf[MAXHOSTNAMELEN + 100]; i = decode_prefix4(p, buf, sizeof(buf)); - if (i == -1) + if (i == -1) { printf("\n\t (illegal prefix length)"); - else if (i == -2) + break; + } else if (i == -2) goto trunc; else { printf("\n\t %s", buf); Index: src/dist/tcpdump/print-isoclns.c diff -u src/dist/tcpdump/print-isoclns.c:1.6.10.1 src/dist/tcpdump/print-isoclns.c:1.6.10.2 --- src/dist/tcpdump/print-isoclns.c:1.6.10.1 Mon Apr 14 21:04:29 2008 +++ src/dist/tcpdump/print-isoclns.c Sun Jun 21 21:30:22 2009 @@ -1,4 +1,4 @@ -/* $NetBSD: print-isoclns.c,v 1.6.10.1 2008/04/14 21:04:29 jdc Exp $ */ +/* $NetBSD: print-isoclns.c,v 1.6.10.2 2009/06/21 21:30:22 snj Exp $ */ /* * Copyright (c) 1992, 1993, 1994, 1995, 1996 @@ -32,7 +32,7 @@ static const char rcsid[] _U_ = "@(#) Header: /tcpdump/master/tcpdump/print-isoclns.c,v 1.106.2.5 2004/03/24 01:45:26 guy Exp (LBL)"; #else -__RCSID("$NetBSD: print-isoclns.c,v 1.6.10.1 2008/04/14 21:04:29 jdc Exp $"); +__RCSID("$NetBSD: print-isoclns.c,v 1.6.10.2 2009/06/21 21:30:22 snj Exp $"); #endif #endif @@ -1522,6 +1522,9 @@ if (tlv_len == 0) /* something is malformed */ continue; + if (tlv_len == 0) /* something is malformed */ + break; + /* now check if we have a decoder otherwise do a hexdump at the end*/ switch (tlv_type) { case TLV_AREA_ADDR: Index: src/dist/tcpdump/print-ldp.c diff -u src/dist/tcpdump/print-ldp.c:1.1.1.1 src/dist/tcpdump/print-ldp.c:1.1.1.1.10.1 --- src/dist/tcpdump/print-ldp.c:1.1.1.1 Mon Sep 27 17:07:12 2004 +++ src/dist/tcpdump/print-ldp.c Sun Jun 21 21:30:23 2009 @@ -1,4 +1,4 @@ -/* $NetBSD: print-ldp.c,v 1.1.1.1 2004/09/27 17:07:12 dyoung Exp $ */ +/* $NetBSD: print-ldp.c,v 1.1.1.1.10.1 2009/06/21 21:30:23 snj Exp $ */ /* * Redistribution and use in source and binary forms, with or without @@ -328,6 +328,9 @@ EXTRACT_32BITS(&ldp_msg_header->id), LDP_MASK_U_BIT(EXTRACT_16BITS(&ldp_msg_header->type)) ? "continue processing" : "ignore"); + if (msg_len == 0) /* infinite loop protection */ + break; + msg_tptr=tptr+sizeof(struct ldp_msg_header); msg_tlen=msg_len-sizeof(struct ldp_msg_header)+4; /* Type & Length fields not included */ Index: src/dist/tcpdump/print-rsvp.c diff -u src/dist/tcpdump/print-rsvp.c:1.1.1.1 src/dist/tcpdump/print-rsvp.c:1.1.1.1.10.1 --- src/dist/tcpdump/print-rsvp.c:1.1.1.1 Mon Sep 27 17:07:24 2004 +++ src/dist/tcpdump/print-rsvp.c Sun Jun 21 21:30:23 2009 @@ -1,4 +1,4 @@ -/* $NetBSD: print-rsvp.c,v 1.1.1.1 2004/09/27 17:07:24 dyoung Exp $ */ +/* $NetBSD: print-rsvp.c,v 1.1.1.1.10.1 2009/06/21 21:30:23 snj Exp $ */ /* * Redistribution and use in source and binary forms, with or without @@ -877,10 +877,17 @@ switch(rsvp_obj_ctype) { case RSVP_CTYPE_IPV4: while(obj_tlen >= 4 ) { - printf("\n\t Subobject Type: %s", + printf("\n\t Subobject Type: %s, length %u", tok2str(rsvp_obj_xro_values, "Unknown %u", - RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr))); + RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)), + *(obj_tptr+1)); + + if (*(obj_tptr+1) == 0) { /* prevent infinite loops */ + printf("\n\t ERROR: zero length ERO subtype"); + break; + } + switch(RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)) { case RSVP_OBJ_XRO_IPV4: printf(", %s, %s/%u, Flags: [%s]",