Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix length checks in VLAN/Ethernet analyzers for non-ethertype protocols

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-04-24 12:14:45 -07:00 • committed by Tim Wojtulewicz
parent 7aa7909c94
commit 7facd94e6f
2 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/packet_analysis/protocol/ethernet/Ethernet.cc
View file

@ -53,18 +53,16 @@ bool EthernetAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
// Other ethernet frame types
if ( protocol <= 1500 )
{
if ( 16 >= len )
len -= 14;
data += 14;
if ( len < protocol )
{
Weird("truncated_ethernet_frame", packet);
return false;
}
len -= 14;
data += 14;
// Let specialized analyzers take over for non Ethernet II frames. We use magic numbers here
// to denote the protocols for the forwarding. We know these numbers should be valid because
// any others used should be >= 1536, as above.
// Let specialized analyzers take over for non Ethernet II frames.
if ( data[0] == 0xAA && data[1] == 0xAA )
// IEEE 802.2 SNAP
return ForwardPacket(len, data, packet, snap_forwarding_key);

11
src/packet_analysis/protocol/vlan/VLAN.cc
View file

@ -34,8 +34,15 @@ bool VLANAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet
if ( protocol <= 1500 )
{
// We use magic numbers here to denote the protocols for the forwarding. We know these
// numbers should be valid because any others used should be > 1500, as above.
// Skip over the VLAN header
len -= 4;
data += 4;
if ( len < protocol )
{
Weird("truncated_vlan_frame", packet);
return false;
}
if ( data[0] == 0xAA && data[1] == 0xAA )
// IEEE 802.2 SNAP