tcpdump CDP crashes

[Michael McConville]

The crashes you posted to icb recently
(https://www.sccs.swarthmore.edu/users/16/mmcconv1/dump/tcpdump-crashes/)
are related to print-cdp.c where the bounds checks are missing/broken.
The attached diff seems to fix the issues.

canacar@ asked me to forward this to the list. It makes sense to me, but
it needs review by someone with more knowledge of tcpdump's woeful ways
of buffer handling.


Index: print-cdp.c
===================================================================
RCS file: /cvs/src/usr.sbin/tcpdump/print-cdp.c,v
retrieving revision 1.5
diff -u -p -u -p -r1.5 print-cdp.c
--- print-cdp.c 16 Jan 2015 06:40:21 -0000 1.5
+++ print-cdp.c 28 Jan 2016 05:22:51 -0000
@@ -65,7 +65,7 @@ cdp_print(const u_char *p, u_int length,

while (i < length) {
if (i + 4 > caplen) {
- printf("[!cdp]");
+ printf("[|cdp]");
return;
}

@@ -75,8 +75,11 @@ cdp_print(const u_char *p, u_int length,
if (vflag)
printf(" %02x/%02x", type, len);

+ if (len < 4)
+ goto error;
+
if (i+len > caplen) {
- printf("[!cdp]");
+ printf("[|cdp]");
return;
}

@@ -92,6 +95,8 @@ cdp_print(const u_char *p, u_int length,
printf(" PortID '%.*s'", len - 4, p + i + 4);
break;
case 0x04:
+ if (len < 7)
+ goto error;
printf(" CAP 0x%02x", (unsigned) p[i+7]);
break;
case 0x05:
@@ -110,6 +115,8 @@ cdp_print(const u_char *p, u_int length,
printf(" VTP-Management-Domain '%.*s'", len-4, p+i+4 );
break;
case 0x0a: /* guess - not documented */
+ if (len < 5)
+ goto error;
printf(" Native-VLAN-ID %d", (p[i+4]<<8) + p[i+4+1] - 1 );
break;
case 0x0b: /* guess - not documented */
@@ -124,6 +131,9 @@ cdp_print(const u_char *p, u_int length,
break;
i += len;
}
+ return;
+error:
+ printf("[!cdp]");
}

void
@@ -137,13 +147,20 @@ cdp_print_addr(const u_char * p, int l)

printf(" (%d): ", num);

- while(p < endp && num >= 0) {
+ while(num >= 0) {
+ if (p + 1 >= endp)
+ break;
pl=*(p+1);
p+=2;

+ if (p + l + 2 >= endp)
+ break;
+
/* special case: IPv4, protocol type=0xcc, addr. length=4 */
if (pl == 1 && *p == 0xcc && p[1] == 0 && p[2] == 4) {
p+=3;
+ if (p + 4 >= endp)
+ break;

printf("IPv4 %d.%d.%d.%d ", p[0], p[1], p[2], p[3]);
p+=4;
@@ -154,6 +171,8 @@ cdp_print_addr(const u_char * p, int l)
al=(*p << 8) + *(p+1);
printf(", al=%d, a=", al);
p+=2;
+ if (p + al >= endp)
+ break;
while(al-- > 0)
printf(" %02x", *p++);
}
@@ -169,7 +188,8 @@ cdp_print_prefixes(const u_char * p, int
printf(" IPv4 Prefixes (%d):", l/5);

while (l > 0) {
- printf(" %d.%d.%d.%d/%d", p[0], p[1], p[2], p[3], p[4] );
+ if (l >= 5)
+ printf(" %d.%d.%d.%d/%d", p[0], p[1], p[2], p[3], p[4] );
l-=5; p+=5;
}
}