Check payload size more carefully when printing ike messages. Identified by

cloder@.

ok ho@ otto@ cloder@

2 files changed, 35 insertions, 6 deletions

diff --git a/usr.sbin/tcpdump/ike.h b/usr.sbin/tcpdump/ike.h
index 55fc3a2ac19..4ea72037e5b 100644
--- a/usr.sbin/tcpdump/ike.h
+++ b/usr.sbin/tcpdump/ike.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ike.h,v 1.6 2003/12/18 09:14:18 ho Exp $ */
+/* $OpenBSD: ike.h,v 1.7 2004/03/12 10:10:42 hshoexer Exp $ */
 
 /*
  * Copyright (c) 2001 Håkan Olsson.  All rights reserved.
@@ -111,6 +111,7 @@
 #define PAYLOAD_ATTRIBUTE	14
 #define PAYLOAD_NAT_D		15
 #define PAYLOAD_NAT_OA		16
+#define PAYLOAD_RESERVED_MIN	17
 
 #define IKE_PAYLOAD_TYPES_INITIALIZER			\
 	{ "NONE",		/*  0 */		\
@@ -355,3 +356,27 @@
 	  "INTERNAL_IP6_DHCP", "INTERNAL_IP4_SUBNET",		\
 	  "SUPPORTED_ATTRIBUTES", "INTERNAL_IP6_SUBNET",	\
 	}
+
+#define ISAKMP_SA_SZ		 8
+#define ISAKMP_PROP_SZ		 8
+#define ISAKMP_TRANSFORM_SZ	 8
+#define ISAKMP_KE_SZ		 4
+#define ISAKMP_ID_SZ		 8
+#define ISAKMP_CERT_SZ		 5
+#define ISAKMP_CERTREQ_SZ	 5
+#define ISAKMP_HASH_SZ		 4
+#define ISAKMP_SIG_SZ		 4
+#define ISAKMP_NONCE_SZ		 4
+#define ISAKMP_NOTIFY_SZ	12
+#define ISAKMP_DELETE_SZ	12
+#define ISAKMP_VENDOR_SZ	 4
+#define ISAKMP_ATTRIBUTE_SZ	 8
+#define ISAKMP_NAT_D_SZ		 4
+#define ISAKMP_NAT_OA_SZ	 8
+
+static u_int16_t min_payload_lengths[] = {
+  0, ISAKMP_SA_SZ, ISAKMP_PROP_SZ, ISAKMP_TRANSFORM_SZ, ISAKMP_KE_SZ,
+  ISAKMP_ID_SZ, ISAKMP_CERT_SZ, ISAKMP_CERTREQ_SZ, ISAKMP_HASH_SZ,
+  ISAKMP_SIG_SZ, ISAKMP_NONCE_SZ, ISAKMP_NOTIFY_SZ, ISAKMP_DELETE_SZ,
+  ISAKMP_VENDOR_SZ, ISAKMP_ATTRIBUTE_SZ, ISAKMP_NAT_D_SZ, ISAKMP_NAT_OA_SZ
+};
diff --git a/usr.sbin/tcpdump/print-ike.c b/usr.sbin/tcpdump/print-ike.c
index 9b32aaebfde..70cc59f118f 100644
--- a/usr.sbin/tcpdump/print-ike.c
+++ b/usr.sbin/tcpdump/print-ike.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: print-ike.c,v 1.19 2004/02/14 11:36:55 ho Exp $	*/
+/*	$OpenBSD: print-ike.c,v 1.20 2004/03/12 10:10:42 hshoexer Exp $	*/
 
 /*
  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999
@@ -29,7 +29,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-ike.c,v 1.19 2004/02/14 11:36:55 ho Exp $ (XXX)";
+    "@(#) $Header: /cvs/OpenBSD/src/usr.sbin/tcpdump/print-ike.c,v 1.20 2004/03/12 10:10:42 hshoexer Exp $ (XXX)";
 #endif
 
 #include <sys/param.h>
@@ -632,13 +632,17 @@ void
 ike_pl_print (u_int8_t type, u_int8_t *buf, u_int8_t doi)
 {
 	static const char *pltypes[] = IKE_PAYLOAD_TYPES_INITIALIZER;
-	int next_type = buf[0];
-	int this_len = buf[2]<<8 | buf[3];
+	u_int8_t next_type = buf[0];
+	u_int16_t this_len = buf[2]<<8 | buf[3];
 
-	printf("\n\t%spayload: %s len: %d", ike_tab_offset(),
+	printf("\n\t%spayload: %s len: %hu", ike_tab_offset(),
 	    (type < (sizeof pltypes/sizeof pltypes[0]) ?
 	    pltypes[type] : "<unknown>"), this_len);
 
+	if ((type < PAYLOAD_RESERVED_MIN
+	    && this_len < min_payload_lengths[type]) || this_len == 0)
+		goto pltrunc;
+
 	if ((u_int8_t *)&(buf[0]) > snapend - this_len)
 		goto pltrunc;