Parcourir la source

[arp] Validate length of ARP packet

There is no practical way to generate an underlength ARP packet since
an ARP packet is always padded up to the minimum Ethernet frame length
(or dropped by the receiving Ethernet hardware if incorrectly padded),
but the absence of an explicit check causes warnings from some
analysis tools.

Fix by adding an explicit check on the I/O buffer length.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown il y a 8 ans
Parent
révision
64acfd9ddd
2 fichiers modifiés avec 17 ajouts et 0 suppressions
  1. 10
    0
      src/include/ipxe/if_arp.h
  2. 7
    0
      src/net/arp.c

+ 10
- 0
src/include/ipxe/if_arp.h Voir le fichier

@@ -99,4 +99,14 @@ static inline void * arp_target_pa ( struct arphdr *arphdr ) {
99 99
 	return ( arp_target_ha ( arphdr ) + arphdr->ar_hln );
100 100
 }
101 101
 
102
+/** ARP packet length
103
+ *
104
+ * @v arphdr	ARP header
105
+ * @ret len	Length (including header)
106
+ */
107
+static inline size_t arp_len ( struct arphdr *arphdr ) {
108
+	return ( sizeof ( *arphdr ) +
109
+		 ( 2 * ( arphdr->ar_hln + arphdr->ar_pln ) ) );
110
+}
111
+
102 112
 #endif	/* _IPXE_IF_ARP_H */

+ 7
- 0
src/net/arp.c Voir le fichier

@@ -139,8 +139,15 @@ static int arp_rx ( struct io_buffer *iobuf, struct net_device *netdev,
139 139
 	struct arp_net_protocol *arp_net_protocol;
140 140
 	struct net_protocol *net_protocol;
141 141
 	struct ll_protocol *ll_protocol;
142
+	size_t len = iob_len ( iobuf );
142 143
 	int rc;
143 144
 
145
+	/* Sanity check */
146
+	if ( ( len < sizeof ( *arphdr ) ) || ( len < arp_len ( arphdr ) ) ) {
147
+		rc = -EINVAL;
148
+		goto done;
149
+	}
150
+
144 151
 	/* Identify network-layer and link-layer protocols */
145 152
 	arp_net_protocol = arp_find_protocol ( arphdr->ar_pro );
146 153
 	if ( ! arp_net_protocol ) {

Chargement…
Annuler
Enregistrer