Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add a few extra length checks to Teredo::DetectProtocol

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-01-27 10:37:24 -07:00
parent 9a96e3b52a
commit 2866bbea4d
1 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/packet_analysis/protocol/teredo/Teredo.cc
View file

@ -272,8 +272,8 @@ bool TeredoAnalyzer::DetectProtocol(size_t len, const uint8_t* data, Packet* pac
// Do some fast checks that must be true before moving to more complicated ones. // Do some fast checks that must be true before moving to more complicated ones.
// Mostly this avoids doing the regex below if we can help it. // Mostly this avoids doing the regex below if we can help it.
if ( (len < 40) || if ( (len < 40) || ((len > 8) && ((data[0] >> 4) != 6) &&
(((data[0] >> 4) != 6) && ((data[0] != 0x00) || (data[1] != 0x00 && data[1] != 0x01))) ) ((data[0] != 0x00) || (data[1] != 0x00 && data[1] != 0x01))) )
return false; return false;
if ( pattern_re->Match(data, len) ) if ( pattern_re->Match(data, len) )
@ -291,6 +291,9 @@ bool TeredoAnalyzer::DetectProtocol(size_t len, const uint8_t* data, Packet* pac
uint8_t client_id_length = data[2]; uint8_t client_id_length = data[2];
uint8_t auth_length = data[3]; uint8_t auth_length = data[3];
if ( len < (13 + client_id_length + auth_length) )
return false;
// There's 9 bytes at the end of the header for a nonce value and a // There's 9 bytes at the end of the header for a nonce value and a
// confirmation byte. That plus the 4 bytes we've looked at already // confirmation byte. That plus the 4 bytes we've looked at already
// makes 13 bytes. // makes 13 bytes.
@ -307,6 +310,9 @@ bool TeredoAnalyzer::DetectProtocol(size_t len, const uint8_t* data, Packet* pac
if ( val == 0 ) if ( val == 0 )
{ {
if ( len < 8 )
return false;
// If the second byte is zero (or we're coming out of an authentication // If the second byte is zero (or we're coming out of an authentication
// header), we're in an origin identification header. Skip over it, and // header), we're in an origin identification header. Skip over it, and
// verify there's enough data after it to find an IPv6 header. // verify there's enough data after it to find an IPv6 header.