Pārlūkot izejas kodu

[arp] Validate length of ARP packet

There is no practical way to generate an underlength ARP packet since
an ARP packet is always padded up to the minimum Ethernet frame length
(or dropped by the receiving Ethernet hardware if incorrectly padded),
but the absence of an explicit check causes warnings from some
analysis tools.

Fix by adding an explicit check on the I/O buffer length.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 8 gadus atpakaļ
vecāks
revīzija
64acfd9ddd
2 mainītis faili ar 17 papildinājumiem un 0 dzēšanām
  1. 10
    0
      src/include/ipxe/if_arp.h
  2. 7
    0
      src/net/arp.c

+ 10
- 0
src/include/ipxe/if_arp.h Parādīt failu

@@ -99,4 +99,14 @@ static inline void * arp_target_pa ( struct arphdr *arphdr ) {
99 99
 	return ( arp_target_ha ( arphdr ) + arphdr->ar_hln );
100 100
 }
101 101
 
102
+/** ARP packet length
103
+ *
104
+ * @v arphdr	ARP header
105
+ * @ret len	Length (including header)
106
+ */
107
+static inline size_t arp_len ( struct arphdr *arphdr ) {
108
+	return ( sizeof ( *arphdr ) +
109
+		 ( 2 * ( arphdr->ar_hln + arphdr->ar_pln ) ) );
110
+}
111
+
102 112
 #endif	/* _IPXE_IF_ARP_H */

+ 7
- 0
src/net/arp.c Parādīt failu

@@ -139,8 +139,15 @@ static int arp_rx ( struct io_buffer *iobuf, struct net_device *netdev,
139 139
 	struct arp_net_protocol *arp_net_protocol;
140 140
 	struct net_protocol *net_protocol;
141 141
 	struct ll_protocol *ll_protocol;
142
+	size_t len = iob_len ( iobuf );
142 143
 	int rc;
143 144
 
145
+	/* Sanity check */
146
+	if ( ( len < sizeof ( *arphdr ) ) || ( len < arp_len ( arphdr ) ) ) {
147
+		rc = -EINVAL;
148
+		goto done;
149
+	}
150
+
144 151
 	/* Identify network-layer and link-layer protocols */
145 152
 	arp_net_protocol = arp_find_protocol ( arphdr->ar_pro );
146 153
 	if ( ! arp_net_protocol ) {

Notiek ielāde…
Atcelt
Saglabāt