j3d1/tinc
1
0
Fork 0
Code Issues 1 Pull requests Releases Wiki Activity

Better length checks.

Browse source
This commit is contained in:
Guus Sliepen 2003-10-01 09:14:01 +00:00
parent eeb97e3ef4
commit acbb9d6692
1 changed files with 29 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
src/route.c
View file

@ -17,7 +17,7 @@
along with this program; if not, write to the Free Software along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
$Id: route.c,v 1.1.2.65 2003/09/23 20:59:01 guus Exp $ $Id: route.c,v 1.1.2.66 2003/10/01 09:14:01 guus Exp $
*/ */
#include "system.h" #include "system.h"
@ -532,7 +532,7 @@ void route_outgoing(vpn_packet_t *packet)
cp(); cp();
if(packet->len < 64) { if(packet->len < 14) {
ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet")); ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
return; return;
} }
@ -544,11 +544,21 @@ void route_outgoing(vpn_packet_t *packet)
type = ntohs(*((uint16_t *)(&packet->data[12]))); type = ntohs(*((uint16_t *)(&packet->data[12])));
switch (type) { switch (type) {
case 0x0800: case 0x0800:
if(packet->len < 34) {
ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
return;
}
n = route_ipv4(packet); n = route_ipv4(packet);
break; break;
case 0x86DD: case 0x86DD:
if(packet->data[20] == IPPROTO_ICMPV6 && packet->data[54] == ND_NEIGHBOR_SOLICIT) { if(packet->len < 54) {
ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
return;
}
if(packet->data[20] == IPPROTO_ICMPV6 && packet->len >= 62 && packet->data[54] == ND_NEIGHBOR_SOLICIT) {
route_neighborsol(packet); route_neighborsol(packet);
return; return;
} }
@ -556,6 +566,11 @@ void route_outgoing(vpn_packet_t *packet)
break; break;
case 0x0806: case 0x0806:
if(packet->len < 42) {
ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
return;
}
route_arp(packet); route_arp(packet);
return; return;
@ -583,7 +598,7 @@ void route_outgoing(vpn_packet_t *packet)
void route_incoming(node_t *source, vpn_packet_t *packet) void route_incoming(node_t *source, vpn_packet_t *packet)
{ {
if(packet->len < 64) { if(packet->len < 14) {
ifdebug(TRAFFIC) logger(LOG_WARNING, _("Got too short packet from %s (%s)"), ifdebug(TRAFFIC) logger(LOG_WARNING, _("Got too short packet from %s (%s)"),
source->name, source->hostname); source->name, source->hostname);
return; return;
@ -598,10 +613,20 @@ void route_incoming(node_t *source, vpn_packet_t *packet)
type = ntohs(*((uint16_t *)(&packet->data[12]))); type = ntohs(*((uint16_t *)(&packet->data[12])));
switch (type) { switch (type) {
case 0x0800: case 0x0800:
if(packet->len < 34) {
ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
return;
}
n = route_ipv4(packet); n = route_ipv4(packet);
break; break;
case 0x86DD: case 0x86DD:
if(packet->len < 54) {
ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
return;
}
n = route_ipv6(packet); n = route_ipv6(packet);
break; break;