Bug #488 heap overflow csum replace4

docs/CHANGELOG

@@ -1,5 +1,6 @@
 10/18/2018 Version 4.3.0 beta2
     - fix issues identifed by Codacy (#493)
+    - CVE-2018-18407 heap-buffer-overflow csum_replace4 (#488)
     - CVE-2018-17974 heap-buffer-overflow dlt_en10mb_encode (#486)
     - CVE-2018-17582 heap-buffer-overflow in get_next_packet (#484)
     - CVE-2018-13112 heap-buffer-overflow in get_l2len (#477 dup #408)

src/bridge.c

@@ -339,7 +339,8 @@ live_callback(struct live_data_t *livedata, struct pcap_pkthdr *pkthdr,
 
         /* look for include or exclude CIDR match */
         if (livedata->options->xX.cidr != NULL) {
-            if (!process_xX_by_cidr_ipv4(livedata->options->xX.mode, livedata->options->xX.cidr, ip_hdr)) {
+            if (!ip_hdr ||
+                    !process_xX_by_cidr_ipv4(livedata->options->xX.mode, livedata->options->xX.cidr, ip_hdr)) {
                 dbg(2, "Skipping IPv4 packet due to CIDR match");
                 return (1);
             }

src/common/flows.c

@@ -158,7 +158,6 @@ flow_entry_type_t flow_decode(flow_hash_table_t *fht, const struct pcap_pkthdr *
         const u_char *pktdata, const int datalink, const int expiry)
 {
     uint16_t ether_type = 0;
-    vlan_hdr_t *vlan_hdr;
     ipv4_hdr_t *ip_hdr = NULL;
     ipv6_hdr_t *ip6_hdr = NULL;
     tcp_hdr_t *tcp_hdr;
@@ -231,10 +230,11 @@ flow_entry_type_t flow_decode(flow_hash_table_t *fht, const struct pcap_pkthdr *
         if ((pktdata[3] & 0x80) == 0x80) {
             l2_len = ntohs(*((uint16_t*)&pktdata[4]));
             l2_len += 6;
-        } else
+        } else {
             l2_len = 4; /* no header extensions */
+        }
 
-        /* fall through */
+        /* no break */
     case DLT_EN10MB:
         /* set l2_len if we did not fell through */
         if (l2_len == 0)
@@ -246,7 +246,7 @@ flow_entry_type_t flow_decode(flow_hash_table_t *fht, const struct pcap_pkthdr *
         ether_type = ntohs(((eth_hdr_t*)(pktdata + l2_len))->ether_type);
 
         while (ether_type == ETHERTYPE_VLAN) {
-            vlan_hdr = (vlan_hdr_t *)(pktdata + l2_len);
+            vlan_hdr_t *vlan_hdr = (vlan_hdr_t *)(pktdata + l2_len);
             entry.vlan = vlan_hdr->vlan_priority_c_vid & htons(0xfff);
             ether_type = ntohs(vlan_hdr->vlan_len);
             l2_len += 4;

src/common/get.c

@@ -78,7 +78,6 @@ get_pcap_version(void)
 uint16_t
 get_l2protocol(const u_char *pktdata, const int datalen, const int datalink)
 {
-    uint16_t ether_type;
     uint16_t eth_hdr_offset = 0;
 
     if (!pktdata || !datalen) {
@@ -111,7 +110,7 @@ get_l2protocol(const u_char *pktdata, const int datalen, const int datalink)
         if (datalen >= (sizeof(eth_hdr_t) + eth_hdr_offset)) {
             vlan_hdr_t *vlan_hdr;
             eth_hdr_t *eth_hdr = (eth_hdr_t *)(pktdata + eth_hdr_offset);
-            ether_type = ntohs(eth_hdr->ether_type);
+            uint16_t ether_type = ntohs(eth_hdr->ether_type);
             switch (ether_type) {
             case ETHERTYPE_VLAN: /* 802.1q */
                 vlan_hdr = (vlan_hdr_t *)pktdata;
@@ -359,8 +358,7 @@ get_layer4_v4(const ipv4_hdr_t *ip_hdr, const int len)
 
     assert(ip_hdr);
 
-    ptr = (uint32_t *) ip_hdr + ip_hdr->ip_hl;
-
+    ptr = (u_char *)ip_hdr + (ip_hdr->ip_hl << 2);
     /* make sure we don't jump over the end of the buffer */
     if ((u_char *)ptr > ((u_char *)ip_hdr + len))
         return NULL;
@@ -391,7 +389,7 @@ get_layer4_v6(const ipv6_hdr_t *ip6_hdr, const int len)
     next = (struct tcpr_ipv6_ext_hdr_base *)((u_char *)ip6_hdr + TCPR_IPV6_H);
     proto = ip6_hdr->ip_nh;
 
-    while (TRUE) {
+    while (1) {
         dbgx(3, "Processing proto: 0x%hx", (uint16_t)proto);
 
         switch (proto) {
@@ -502,14 +500,18 @@ get_ipv6_next(struct tcpr_ipv6_ext_hdr_base *exthdr, const int len)
  * the extension headers
  */
 uint8_t 
-get_ipv6_l4proto(const ipv6_hdr_t *ip6_hdr, const int len)
+get_ipv6_l4proto(const ipv6_hdr_t *ip6_hdr, int len)
 {
     u_char *ptr = (u_char *)ip6_hdr + TCPR_IPV6_H; /* jump to the end of the IPv6 header */
     uint8_t proto;
     struct tcpr_ipv6_ext_hdr_base *exthdr = NULL;
 
     assert(ip6_hdr);
+
     proto = ip6_hdr->ip_nh;
+    len -= TCPR_IPV6_H;
+    if (len < 0)
+        return proto;
 
     while (TRUE) {
         dbgx(3, "Processing next proto 0x%02X", proto);

src/common/get.h

@@ -33,7 +33,7 @@ u_int16_t get_l2protocol(const u_char *pktdata, const int datalen, const int dat
 void *get_layer4_v4(const ipv4_hdr_t *ip_hdr, const int len);
 void *get_layer4_v6(const ipv6_hdr_t *ip_hdr, const int len);
 
-u_int8_t get_ipv6_l4proto(const ipv6_hdr_t *ip6_hdr, const int len);
+u_int8_t get_ipv6_l4proto(const ipv6_hdr_t *ip6_hdr, int len);
 void *get_ipv6_next(struct tcpr_ipv6_ext_hdr_base *exthdr, const int len);
 
 const u_char *get_ipv4(const u_char *pktdata, int datalen, int datalink, u_char **newbuff);

src/tcpedit/edit_packet.c

@@ -232,18 +232,37 @@ static void ipv6_l34_csum_replace(uint8_t *data, uint8_t protocol,
 
 }
 
-static void ipv4_addr_csum_replace(ipv4_hdr_t *ip_hdr, uint32_t old_ip, uint32_t new_ip)
+static void ipv4_addr_csum_replace(ipv4_hdr_t *ip_hdr, uint32_t old_ip,
+        uint32_t new_ip, int len)
 {
-    uint8_t *l4 = NULL, protocol;
+    uint8_t *l4, protocol;
+
     assert(ip_hdr);
 
+    if (len < sizeof(*ip_hdr))
+        return;
+
     ipv4_l34_csum_replace((uint8_t*)ip_hdr, IPPROTO_IP, old_ip, new_ip);
 
-      protocol = ip_hdr->ip_p;
-    if (protocol == IPPROTO_TCP || protocol == IPPROTO_UDP)
-        l4 = get_layer4_v4(ip_hdr, 65536);
+    protocol = ip_hdr->ip_p;
+    switch (protocol) {
+    case IPPROTO_UDP:
+        l4 = get_layer4_v4(ip_hdr, len);
+        len -= ip_hdr->ip_hl << 2;
+        len -= TCPR_UDP_H;
+        break;
+
+    case IPPROTO_TCP:
+        l4 = get_layer4_v4(ip_hdr, len);
+        len -= ip_hdr->ip_hl << 2;
+        len -= TCPR_TCP_H;
+        break;
+
+    default:
+        l4 = NULL;
+    }
 
-    if (!l4)
+    if (!l4 || len < 0)
         return;
 
     /* if this is a fragment, don't attempt to checksum the Layer4 header */
@@ -252,17 +271,34 @@ static void ipv4_addr_csum_replace(ipv4_hdr_t *ip_hdr, uint32_t old_ip, uint32_t
 }
 
 static void ipv6_addr_csum_replace(ipv6_hdr_t *ip6_hdr,
-        struct tcpr_in6_addr *old_ip, struct tcpr_in6_addr *new_ip)
+        struct tcpr_in6_addr *old_ip, struct tcpr_in6_addr *new_ip, int len)
 {
-    uint8_t *l4 = NULL, protocol;
+    uint8_t *l4, protocol;
+
     assert(ip6_hdr);
 
-    protocol = get_ipv6_l4proto(ip6_hdr, 65536);
-    if (protocol == IPPROTO_TCP || protocol == IPPROTO_UDP ||
-            protocol == IPPROTO_ICMP || protocol == IPPROTO_ICMP6)
-        l4 = get_layer4_v6(ip6_hdr, 65536);
+    if (len < sizeof(*ip6_hdr))
+        return;
+
+    protocol = get_ipv6_l4proto(ip6_hdr, len);
+    switch (protocol) {
+    case IPPROTO_UDP:
+        l4 = get_layer4_v6(ip6_hdr, len);
+        len -= sizeof(*ip6_hdr);
+        len -= TCPR_UDP_H;
+        break;
+
+    case IPPROTO_TCP:
+        l4 = get_layer4_v6(ip6_hdr, len);
+        len -= sizeof(*ip6_hdr);
+        len -= TCPR_TCP_H;
+        break;
+
+    default:
+        l4 = NULL;
+    }
 
-    if (!l4)
+    if (!l4 || len < 0)
         return;
 
     ipv6_l34_csum_replace(l4, protocol, (uint32_t*)old_ip, (uint32_t*)new_ip);
@@ -317,7 +353,7 @@ randomize_ipv6_addr(tcpedit_t *tcpedit, struct tcpr_in6_addr *addr)
  */
 int
 randomize_ipv4(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr, 
-        u_char *pktdata, ipv4_hdr_t *ip_hdr)
+        u_char *pktdata, ipv4_hdr_t *ip_hdr, int len)
 {
 #ifdef DEBUG
     char srcip[16], dstip[16];
@@ -340,14 +376,14 @@ randomize_ipv4(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
             || !tcpedit->skip_broadcast) {
         uint32_t old_ip = ip_hdr->ip_dst.s_addr;
         ip_hdr->ip_dst.s_addr = randomize_ipv4_addr(tcpedit, ip_hdr->ip_dst.s_addr);
-        ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_dst.s_addr);
+        ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_dst.s_addr, len);
     }
 
     if ((tcpedit->skip_broadcast && is_unicast_ipv4(tcpedit, (u_int32_t)ip_hdr->ip_src.s_addr))
             || !tcpedit->skip_broadcast) {
         uint32_t old_ip = ip_hdr->ip_src.s_addr;
         ip_hdr->ip_src.s_addr = randomize_ipv4_addr(tcpedit, ip_hdr->ip_src.s_addr);
-        ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_src.s_addr);
+        ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_src.s_addr, len);
     }
 
 #ifdef DEBUG    
@@ -362,7 +398,7 @@ randomize_ipv4(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
 
 int
 randomize_ipv6(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
-        u_char *pktdata, ipv6_hdr_t *ip6_hdr)
+        u_char *pktdata, ipv6_hdr_t *ip6_hdr, int len)
 {
 #ifdef DEBUG
     char srcip[INET6_ADDRSTRLEN], dstip[INET6_ADDRSTRLEN];
@@ -386,15 +422,15 @@ randomize_ipv6(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
         struct tcpr_in6_addr old_ip6;
         memcpy(&old_ip6, &ip6_hdr->ip_dst, sizeof(old_ip6));
         randomize_ipv6_addr(tcpedit, &ip6_hdr->ip_dst);
-        ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_dst);
+        ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_dst, len);
     }
 
     if ((tcpedit->skip_broadcast && !is_multicast_ipv6(tcpedit, &ip6_hdr->ip_src))
             || !tcpedit->skip_broadcast) {
         struct tcpr_in6_addr old_ip6;
         memcpy(&old_ip6, &ip6_hdr->ip_src, sizeof(old_ip6));
         randomize_ipv6_addr(tcpedit, &ip6_hdr->ip_src);
-        ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_src);
+        ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_src, len);
     }
 
 #ifdef DEBUG
@@ -759,7 +795,8 @@ remap_ipv6(tcpedit_t *tcpedit, tcpr_cidr_t *cidr, struct tcpr_in6_addr *addr)
  * return 0 if no change, 1 or 2 if changed
  */
 int
-rewrite_ipv4l3(tcpedit_t *tcpedit, ipv4_hdr_t *ip_hdr, tcpr_dir_t direction)
+rewrite_ipv4l3(tcpedit_t *tcpedit, ipv4_hdr_t *ip_hdr, tcpr_dir_t direction,
+        int len)
 {
     tcpr_cidrmap_t *cidrmap1 = NULL, *cidrmap2 = NULL;
     int didsrc = 0, diddst = 0, loop = 1;
@@ -774,7 +811,7 @@ rewrite_ipv4l3(tcpedit_t *tcpedit, ipv4_hdr_t *ip_hdr, tcpr_dir_t direction)
         if (ip_in_cidr(ipmap->from, ip_hdr->ip_src.s_addr)) {
             uint32_t old_ip = ip_hdr->ip_src.s_addr;
             ip_hdr->ip_src.s_addr = remap_ipv4(tcpedit, ipmap->to, ip_hdr->ip_src.s_addr);
-            ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_src.s_addr);
+            ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_src.s_addr, len);
             dbgx(2, "Remapped src addr to: %s", get_addr2name4(ip_hdr->ip_src.s_addr, RESOLVE));
             break;
         }
@@ -786,7 +823,7 @@ rewrite_ipv4l3(tcpedit_t *tcpedit, ipv4_hdr_t *ip_hdr, tcpr_dir_t direction)
         if (ip_in_cidr(ipmap->from, ip_hdr->ip_dst.s_addr)) {
             uint32_t old_ip = ip_hdr->ip_dst.s_addr;
             ip_hdr->ip_dst.s_addr = remap_ipv4(tcpedit, ipmap->to, ip_hdr->ip_dst.s_addr);
-            ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_dst.s_addr);
+            ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_dst.s_addr, len);
             dbgx(2, "Remapped dst addr to: %s", get_addr2name4(ip_hdr->ip_dst.s_addr, RESOLVE));
             break;
         }
@@ -812,14 +849,14 @@ rewrite_ipv4l3(tcpedit_t *tcpedit, ipv4_hdr_t *ip_hdr, tcpr_dir_t direction)
         if ((! diddst) && ip_in_cidr(cidrmap2->from, ip_hdr->ip_dst.s_addr)) {
             uint32_t old_ip = ip_hdr->ip_dst.s_addr;
             ip_hdr->ip_dst.s_addr = remap_ipv4(tcpedit, cidrmap2->to, ip_hdr->ip_dst.s_addr);
-            ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_dst.s_addr);
+            ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_dst.s_addr, len);
             dbgx(2, "Remapped dst addr to: %s", get_addr2name4(ip_hdr->ip_dst.s_addr, RESOLVE));
             diddst = 1;
         }
         if ((! didsrc) && ip_in_cidr(cidrmap1->from, ip_hdr->ip_src.s_addr)) {
             uint32_t old_ip = ip_hdr->ip_src.s_addr;
             ip_hdr->ip_src.s_addr = remap_ipv4(tcpedit, cidrmap1->to, ip_hdr->ip_src.s_addr);
-            ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_src.s_addr);
+            ipv4_addr_csum_replace(ip_hdr, old_ip, ip_hdr->ip_src.s_addr, len);
             dbgx(2, "Remapped src addr to: %s", get_addr2name4(ip_hdr->ip_src.s_addr, RESOLVE));
             didsrc = 1;
         }
@@ -854,7 +891,8 @@ rewrite_ipv4l3(tcpedit_t *tcpedit, ipv4_hdr_t *ip_hdr, tcpr_dir_t direction)
 }
 
 int
-rewrite_ipv6l3(tcpedit_t *tcpedit, ipv6_hdr_t *ip6_hdr, tcpr_dir_t direction)
+rewrite_ipv6l3(tcpedit_t *tcpedit, ipv6_hdr_t *ip6_hdr, tcpr_dir_t direction,
+        int len)
 {
     tcpr_cidrmap_t *cidrmap1 = NULL, *cidrmap2 = NULL;
     int didsrc = 0, diddst = 0, loop = 1;
@@ -870,7 +908,7 @@ rewrite_ipv6l3(tcpedit_t *tcpedit, ipv6_hdr_t *ip6_hdr, tcpr_dir_t direction)
             struct tcpr_in6_addr old_ip6;
             memcpy(&old_ip6, &ip6_hdr->ip_src, sizeof(old_ip6));
             remap_ipv6(tcpedit, ipmap->to, &ip6_hdr->ip_src);
-            ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_src);
+            ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_src, len);
             dbgx(2, "Remapped src addr to: %s", get_addr2name6(&ip6_hdr->ip_src, RESOLVE));
             break;
         }
@@ -883,7 +921,7 @@ rewrite_ipv6l3(tcpedit_t *tcpedit, ipv6_hdr_t *ip6_hdr, tcpr_dir_t direction)
             struct tcpr_in6_addr old_ip6;
             memcpy(&old_ip6, &ip6_hdr->ip_dst, sizeof(old_ip6));
             remap_ipv6(tcpedit, ipmap->to, &ip6_hdr->ip_dst);
-            ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_dst);
+            ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_dst, len);
             dbgx(2, "Remapped dst addr to: %s", get_addr2name6(&ip6_hdr->ip_dst, RESOLVE));
             break;
         }
@@ -910,15 +948,15 @@ rewrite_ipv6l3(tcpedit_t *tcpedit, ipv6_hdr_t *ip6_hdr, tcpr_dir_t direction)
             struct tcpr_in6_addr old_ip6;
             memcpy(&old_ip6, &ip6_hdr->ip_dst, sizeof(old_ip6));
             remap_ipv6(tcpedit, cidrmap2->to, &ip6_hdr->ip_dst);
-            ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_dst);
+            ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_dst, len);
             dbgx(2, "Remapped dst addr to: %s", get_addr2name6(&ip6_hdr->ip_dst, RESOLVE));
             diddst = 1;
         }
         if ((! didsrc) && ip6_in_cidr(cidrmap1->from, &ip6_hdr->ip_src)) {
             struct tcpr_in6_addr old_ip6;
             memcpy(&old_ip6, &ip6_hdr->ip_src, sizeof(old_ip6));
             remap_ipv6(tcpedit, cidrmap1->to, &ip6_hdr->ip_src);
-            ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_src);
+            ipv6_addr_csum_replace(ip6_hdr, &old_ip6, &ip6_hdr->ip_src, len);
             dbgx(2, "Remapped src addr to: %s", get_addr2name6(&ip6_hdr->ip_src, RESOLVE));
             didsrc = 1;
         }

src/tcpedit/edit_packet.h

@@ -28,10 +28,10 @@ int untrunc_packet(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
         u_char **pktdata, ipv4_hdr_t *ip_hdr, ipv6_hdr_t *ip6_hdr);
 
 int randomize_ipv4(tcpedit_t *tcpedit, struct pcap_pkthdr *pktdhr, 
-        u_char *pktdata, ipv4_hdr_t *ip_hdr);
+        u_char *pktdata, ipv4_hdr_t *ip_hdr, int len);
 
 int randomize_ipv6(tcpedit_t *tcpedit, struct pcap_pkthdr *pktdhr,
-        u_char *pktdata, ipv6_hdr_t *ip_hdr);
+        u_char *pktdata, ipv6_hdr_t *ip_hdr, int len);
 
 int randomize_iparp(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr, 
         u_char *pktdata, int datalink);
@@ -49,9 +49,11 @@ void fix_ipv6_length(struct pcap_pkthdr *pkthdr, ipv6_hdr_t *ip6_hdr);
 int extract_data(tcpedit_t *tcpedit, const u_char *pktdata, 
         int caplen, char *l7data[]);
 
-int rewrite_ipv4l3(tcpedit_t *tcpedit, ipv4_hdr_t *ip_hdr, tcpr_dir_t direction);
+int rewrite_ipv4l3(tcpedit_t *tcpedit, ipv4_hdr_t *ip_hdr, tcpr_dir_t direction,
+        int len);
 
-int rewrite_ipv6l3(tcpedit_t *tcpedit, ipv6_hdr_t *ip_hdr, tcpr_dir_t direction);
+int rewrite_ipv6l3(tcpedit_t *tcpedit, ipv6_hdr_t *ip_hdr, tcpr_dir_t direction,
+        int len);
 
 int rewrite_iparp(tcpedit_t *tcpedit, arp_hdr_t *arp_hdr, int direction);
 

src/tcpedit/fuzzing.c

@@ -106,7 +106,7 @@ fuzzing(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
     plugin = tcpedit->dlt_ctx->encoder;
     l2len = plugin->plugin_l2len(ctx, packet, caplen);
     l2proto = ntohs(ctx->proto);
-    if (caplen < l2len)
+    if (l2len == -1 || caplen < l2len)
         goto done;
 
     /*
@@ -124,15 +124,15 @@ fuzzing(tcpedit_t *tcpedit, struct pcap_pkthdr *pkthdr,
     switch (l2proto) {
     case (ETHERTYPE_IP):
     {
-        l4data = get_layer4_v4((ipv4_hdr_t*)l3data, caplen);
+        l4data = get_layer4_v4((ipv4_hdr_t*)l3data, caplen - l2len);
         if (!l4data)
             goto done;
 
         l4proto = ((ipv4_hdr_t *)l3data)->ip_p;
         break;
     }
     case (ETHERTYPE_IP6): {
-        l4data = get_layer4_v6((ipv6_hdr_t*)l3data, caplen);
+        l4data = get_layer4_v6((ipv6_hdr_t*)l3data, caplen - l2len);
         if (!l4data)
             goto done;