delta/tcpdump.git - github.com: the-tcpdump-group/tcpdump.git

	Commit message (Collapse)	Author	Age	Files	Lines
*	Add a sanity check on packet header length	Francois-Xavier Le Bail	2018-02-07	1	-0/+0
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	The packet length must be <= MAXIMUM_SNAPLEN. Currently, there is no D-Bus printer, thus no need for a bigger length. Now a pachet is valid if: capture length != 0, packet length != 0, capture length <= MAXIMUM_SNAPLEN, packet length <= MAXIMUM_SNAPLEN, packet length >= capture length. Moreover: Fix the packet header lengths of some fuzzed pcap files: If the lengths are > MAXIMUM_SNAPLEN, set them to MAXIMUM_SNAPLEN. Thus they will be always usable with this new sanity check.
*	CVE-2017-12898/NFS: Fix bounds checking.	Guy Harris	2017-09-13	1	-0/+0
	Fix the bounds checking for the NFSv3 WRITE procedure to check whether the length of the opaque data being written is present in the captured data, not just whether the byte count is present in the captured data. furthest forward in the packet, not the item before it. (This also lets us eliminate the check for the "stable" argument being present in the captured data; rewrite the code to print that to make it a bit clearer.) Check that the entire ar_stat field is present in the capture. Note that parse_wcc_attr() is called after we've already checked whether the wcc_data is present. Check before fetching the "access" part of the NFSv3 ACCESS results. This fixes a buffer over-read discovered by Kamil Frankowicz. Include a test for the "check before fetching the "access" part..." fix, using the capture supplied by the reporter(s).