projects
/
tinc
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Better length checks.
[tinc]
/
src
/
route.c
diff --git
a/src/route.c
b/src/route.c
index
16d932d
..
e9e07f6
100644
(file)
--- a/
src/route.c
+++ b/
src/route.c
@@
-17,7
+17,7
@@
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- $Id: route.c,v 1.1.2.6
4 2003/08/28 21:05:1
1 guus Exp $
+ $Id: route.c,v 1.1.2.6
6 2003/10/01 09:14:0
1 guus Exp $
*/
#include "system.h"
*/
#include "system.h"
@@
-532,6
+532,11
@@
void route_outgoing(vpn_packet_t *packet)
cp();
cp();
+ if(packet->len < 14) {
+ ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+ return;
+ }
+
/* FIXME: multicast? */
switch (routing_mode) {
/* FIXME: multicast? */
switch (routing_mode) {
@@
-539,11
+544,21
@@
void route_outgoing(vpn_packet_t *packet)
type = ntohs(*((uint16_t *)(&packet->data[12])));
switch (type) {
case 0x0800:
type = ntohs(*((uint16_t *)(&packet->data[12])));
switch (type) {
case 0x0800:
+ if(packet->len < 34) {
+ ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+ return;
+ }
+
n = route_ipv4(packet);
break;
case 0x86DD:
n = route_ipv4(packet);
break;
case 0x86DD:
- if(packet->data[20] == IPPROTO_ICMPV6 && packet->data[54] == ND_NEIGHBOR_SOLICIT) {
+ if(packet->len < 54) {
+ ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+ return;
+ }
+
+ if(packet->data[20] == IPPROTO_ICMPV6 && packet->len >= 62 && packet->data[54] == ND_NEIGHBOR_SOLICIT) {
route_neighborsol(packet);
return;
}
route_neighborsol(packet);
return;
}
@@
-551,6
+566,11
@@
void route_outgoing(vpn_packet_t *packet)
break;
case 0x0806:
break;
case 0x0806:
+ if(packet->len < 42) {
+ ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+ return;
+ }
+
route_arp(packet);
return;
route_arp(packet);
return;
@@
-578,6
+598,12
@@
void route_outgoing(vpn_packet_t *packet)
void route_incoming(node_t *source, vpn_packet_t *packet)
{
void route_incoming(node_t *source, vpn_packet_t *packet)
{
+ if(packet->len < 14) {
+ ifdebug(TRAFFIC) logger(LOG_WARNING, _("Got too short packet from %s (%s)"),
+ source->name, source->hostname);
+ return;
+ }
+
switch (routing_mode) {
case RMODE_ROUTER:
{
switch (routing_mode) {
case RMODE_ROUTER:
{
@@
-587,10
+613,20
@@
void route_incoming(node_t *source, vpn_packet_t *packet)
type = ntohs(*((uint16_t *)(&packet->data[12])));
switch (type) {
case 0x0800:
type = ntohs(*((uint16_t *)(&packet->data[12])));
switch (type) {
case 0x0800:
+ if(packet->len < 34) {
+ ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+ return;
+ }
+
n = route_ipv4(packet);
break;
case 0x86DD:
n = route_ipv4(packet);
break;
case 0x86DD:
+ if(packet->len < 54) {
+ ifdebug(TRAFFIC) logger(LOG_WARNING, _("Read too short packet"));
+ return;
+ }
+
n = route_ipv6(packet);
break;
n = route_ipv6(packet);
break;