Andrew Geissler | c5535c9 | 2023-01-27 16:10:19 -0600 | [diff] [blame^] | 1 | From a75fb7b198eed50d769c80c36629f38346882cbf Mon Sep 17 00:00:00 2001 |
| 2 | From: Paul Mackerras <paulus@ozlabs.org> |
| 3 | Date: Thu, 4 Aug 2022 12:23:08 +1000 |
| 4 | Subject: [PATCH] pppdump: Avoid out-of-range access to packet buffer |
| 5 | |
| 6 | This fixes a potential vulnerability where data is written to spkt.buf |
| 7 | and rpkt.buf without a check on the array index. To fix this, we |
| 8 | check the array index (pkt->cnt) before storing the byte or |
| 9 | incrementing the count. This also means we no longer have a potential |
| 10 | signed integer overflow on the increment of pkt->cnt. |
| 11 | |
| 12 | Fortunately, pppdump is not used in the normal process of setting up a |
| 13 | PPP connection, is not installed setuid-root, and is not invoked |
| 14 | automatically in any scenario that I am aware of. |
| 15 | |
| 16 | Signed-off-by: Paul Mackerras <paulus@ozlabs.org> |
| 17 | |
| 18 | Upstream-Status: Backport |
| 19 | Signed-off-by: Ross Burton <ross.burton@arm.com> |
| 20 | --- |
| 21 | pppdump/pppdump.c | 7 ++++++- |
| 22 | 1 file changed, 6 insertions(+), 1 deletion(-) |
| 23 | |
| 24 | diff --git a/pppdump/pppdump.c b/pppdump/pppdump.c |
| 25 | index 2b815fc9..b85a8627 100644 |
| 26 | --- a/pppdump/pppdump.c |
| 27 | +++ b/pppdump/pppdump.c |
| 28 | @@ -297,6 +297,10 @@ dumpppp(f) |
| 29 | printf("%s aborted packet:\n ", dir); |
| 30 | q = " "; |
| 31 | } |
| 32 | + if (pkt->cnt >= sizeof(pkt->buf)) { |
| 33 | + printf("%s over-long packet truncated:\n ", dir); |
| 34 | + q = " "; |
| 35 | + } |
| 36 | nb = pkt->cnt; |
| 37 | p = pkt->buf; |
| 38 | pkt->cnt = 0; |
| 39 | @@ -400,7 +404,8 @@ dumpppp(f) |
| 40 | c ^= 0x20; |
| 41 | pkt->esc = 0; |
| 42 | } |
| 43 | - pkt->buf[pkt->cnt++] = c; |
| 44 | + if (pkt->cnt < sizeof(pkt->buf)) |
| 45 | + pkt->buf[pkt->cnt++] = c; |
| 46 | break; |
| 47 | } |
| 48 | } |