Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add length checking to ToRawPktHdrVal for truncated packets

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-05-03 10:34:23 -07:00
parent 64f84aba34
commit fc78b14cd7
3 changed files with 34 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/iosource/Packet.cc
View file

@ -117,8 +117,18 @@ RecordValPtr Packet::ToRawPktHdrVal() const
// Ethernet header layout is:
// dst[6bytes] src[6bytes] ethertype[2bytes]...
l2_hdr->Assign(0, BifType::Enum::link_encap->GetEnumVal(BifEnum::LINK_ETHERNET));
l2_hdr->Assign(3, FmtEUI48(data + 6)); // src
l2_hdr->Assign(4, FmtEUI48(data)); // dst
// FmtEUI48 needs at least 6 bytes to print out the mac address, plus 6 bytes for
// skipping over the destination address.
if ( cap_len >= 12 )
l2_hdr->Assign(3, FmtEUI48(data + 6)); // src
else
l2_hdr->Assign(3, "00:00:00:00:00:00");
if ( cap_len >= 6 )
l2_hdr->Assign(4, FmtEUI48(data)); // dst
else
l2_hdr->Assign(4, "00:00:00:00:00:00");
if ( vlan )
l2_hdr->Assign(5, vlan);