Explorar el Código

[arp] Validate length of ARP packet

There is no practical way to generate an underlength ARP packet since
an ARP packet is always padded up to the minimum Ethernet frame length
(or dropped by the receiving Ethernet hardware if incorrectly padded),
but the absence of an explicit check causes warnings from some
analysis tools.

Fix by adding an explicit check on the I/O buffer length.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown hace 8 años
padre
commit
64acfd9ddd
Se han modificado 2 ficheros con 17 adiciones y 0 borrados
  1. 10
    0
      src/include/ipxe/if_arp.h
  2. 7
    0
      src/net/arp.c

+ 10
- 0
src/include/ipxe/if_arp.h Ver fichero

@@ -99,4 +99,14 @@ static inline void * arp_target_pa ( struct arphdr *arphdr ) {
99 99
 	return ( arp_target_ha ( arphdr ) + arphdr->ar_hln );
100 100
 }
101 101
 
102
+/** ARP packet length
103
+ *
104
+ * @v arphdr	ARP header
105
+ * @ret len	Length (including header)
106
+ */
107
+static inline size_t arp_len ( struct arphdr *arphdr ) {
108
+	return ( sizeof ( *arphdr ) +
109
+		 ( 2 * ( arphdr->ar_hln + arphdr->ar_pln ) ) );
110
+}
111
+
102 112
 #endif	/* _IPXE_IF_ARP_H */

+ 7
- 0
src/net/arp.c Ver fichero

@@ -139,8 +139,15 @@ static int arp_rx ( struct io_buffer *iobuf, struct net_device *netdev,
139 139
 	struct arp_net_protocol *arp_net_protocol;
140 140
 	struct net_protocol *net_protocol;
141 141
 	struct ll_protocol *ll_protocol;
142
+	size_t len = iob_len ( iobuf );
142 143
 	int rc;
143 144
 
145
+	/* Sanity check */
146
+	if ( ( len < sizeof ( *arphdr ) ) || ( len < arp_len ( arphdr ) ) ) {
147
+		rc = -EINVAL;
148
+		goto done;
149
+	}
150
+
144 151
 	/* Identify network-layer and link-layer protocols */
145 152
 	arp_net_protocol = arp_find_protocol ( arphdr->ar_pro );
146 153
 	if ( ! arp_net_protocol ) {

Loading…
Cancelar
Guardar