Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix length checks in VLAN/Ethernet analyzers for non-ethertype protocols

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-04-24 12:14:45 -07:00 • committed by Tim Wojtulewicz
parent 7aa7909c94
commit 7facd94e6f
2 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/packet_analysis/protocol/ethernet/Ethernet.cc
View file

@ -53,18 +53,16 @@ bool EthernetAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
// Other ethernet frame types // Other ethernet frame types
if ( protocol <= 1500 ) if ( protocol <= 1500 )
{ {
if ( 16 >= len ) len -= 14;
data += 14;
if ( len < protocol )
{ {
Weird("truncated_ethernet_frame", packet); Weird("truncated_ethernet_frame", packet);
return false; return false;
} }
len -= 14; // Let specialized analyzers take over for non Ethernet II frames.
data += 14;
// Let specialized analyzers take over for non Ethernet II frames. We use magic numbers here
// to denote the protocols for the forwarding. We know these numbers should be valid because
// any others used should be >= 1536, as above.
if ( data[0] == 0xAA && data[1] == 0xAA ) if ( data[0] == 0xAA && data[1] == 0xAA )
// IEEE 802.2 SNAP // IEEE 802.2 SNAP
return ForwardPacket(len, data, packet, snap_forwarding_key); return ForwardPacket(len, data, packet, snap_forwarding_key);

11
src/packet_analysis/protocol/vlan/VLAN.cc
View file

@ -34,8 +34,15 @@ bool VLANAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet
if ( protocol <= 1500 ) if ( protocol <= 1500 )
{ {
// We use magic numbers here to denote the protocols for the forwarding. We know these // Skip over the VLAN header
// numbers should be valid because any others used should be > 1500, as above. len -= 4;
data += 4;
if ( len < protocol )
{
Weird("truncated_vlan_frame", packet);
return false;
}
if ( data[0] == 0xAA && data[1] == 0xAA ) if ( data[0] == 0xAA && data[1] == 0xAA )
// IEEE 802.2 SNAP // IEEE 802.2 SNAP