tinc/src route.c,1.1.2.65,1.1.2.66

[Guus Sliepen <guus@nl.linux.org>]

Update of /home/CVS/tinc/src
In directory humbolt:/tmp/cvs-serv23964

Modified Files:
      Tag: CABAL
	route.c 
Log Message:
Better length checks.


Index: route.c
===================================================================
RCS file: /home/CVS/tinc/src/route.c,v
retrieving revision 1.1.2.65
retrieving revision 1.1.2.66
diff -u -r1.1.2.65 -r1.1.2.66
--- route.c	2003/09/23 20:59:01	1.1.2.65
+++ route.c	2003/10/01 09:14:01	1.1.2.66
@@ -532,7 +532,7 @@
 
 	cp();
 
-	if(packet->len < 64) {
+	if(packet->len < 14) {
 		ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
 		return;
 	}
@@ -544,11 +544,21 @@
 			type = ntohs(*((uint16_t *)(&packet->data[12])));
 			switch (type) {
 				case 0x0800:
+					if(packet->len < 34) {
+						ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+						return;
+					}
+
 					n = route_ipv4(packet);
 					break;
 
 				case 0x86DD:
-					if(packet->data[20] == IPPROTO_ICMPV6 && packet->data[54] == ND_NEIGHBOR_SOLICIT) {
+					if(packet->len < 54) {
+						ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+						return;
+					}
+
+					if(packet->data[20] == IPPROTO_ICMPV6 && packet->len >= 62 && packet->data[54] == ND_NEIGHBOR_SOLICIT) {
 						route_neighborsol(packet);
 						return;
 					}
@@ -556,6 +566,11 @@
 					break;
 
 				case 0x0806:
+					if(packet->len < 42) {
+						ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+						return;
+					}
+
 					route_arp(packet);
 					return;
 
@@ -583,7 +598,7 @@
 
 void route_incoming(node_t *source, vpn_packet_t *packet)
 {
-	if(packet->len < 64) {
+	if(packet->len < 14) {
 		ifdebug(TRAFFIC) logger(LOG_WARNING, _("Got too short packet from %s (%s)"),
 					source->name, source->hostname);
 		return;
@@ -598,10 +613,20 @@
 				type = ntohs(*((uint16_t *)(&packet->data[12])));
 				switch (type) {
 					case 0x0800:
+						if(packet->len < 34) {
+							ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+							return;
+						}
+
 						n = route_ipv4(packet);
 						break;
 
 					case 0x86DD:
+						if(packet->len < 54) {
+							ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+							return;
+						}
+
 						n = route_ipv6(packet);
 						break;
 

--
Tinc-cvs:     CVS changelog list for the tinc VPN daemon
Archive:      http://mail.nl.linux.org/tinc-cvs/
Tinc site:    http://tinc.nl.linux.org/