浏览代码

[arp] Validate length of ARP packet

There is no practical way to generate an underlength ARP packet since
an ARP packet is always padded up to the minimum Ethernet frame length
(or dropped by the receiving Ethernet hardware if incorrectly padded),
but the absence of an explicit check causes warnings from some
analysis tools.

Fix by adding an explicit check on the I/O buffer length.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
tags/v1.20.1
Michael Brown 8 年前
父节点
当前提交
64acfd9ddd
共有 2 个文件被更改,包括 17 次插入0 次删除
  1. 10
    0
      src/include/ipxe/if_arp.h
  2. 7
    0
      src/net/arp.c

+ 10
- 0
src/include/ipxe/if_arp.h 查看文件

@@ -99,4 +99,14 @@ static inline void * arp_target_pa ( struct arphdr *arphdr ) {
99 99
 	return ( arp_target_ha ( arphdr ) + arphdr->ar_hln );
100 100
 }
101 101
 
102
+/** ARP packet length
103
+ *
104
+ * @v arphdr	ARP header
105
+ * @ret len	Length (including header)
106
+ */
107
+static inline size_t arp_len ( struct arphdr *arphdr ) {
108
+	return ( sizeof ( *arphdr ) +
109
+		 ( 2 * ( arphdr->ar_hln + arphdr->ar_pln ) ) );
110
+}
111
+
102 112
 #endif	/* _IPXE_IF_ARP_H */

+ 7
- 0
src/net/arp.c 查看文件

@@ -139,8 +139,15 @@ static int arp_rx ( struct io_buffer *iobuf, struct net_device *netdev,
139 139
 	struct arp_net_protocol *arp_net_protocol;
140 140
 	struct net_protocol *net_protocol;
141 141
 	struct ll_protocol *ll_protocol;
142
+	size_t len = iob_len ( iobuf );
142 143
 	int rc;
143 144
 
145
+	/* Sanity check */
146
+	if ( ( len < sizeof ( *arphdr ) ) || ( len < arp_len ( arphdr ) ) ) {
147
+		rc = -EINVAL;
148
+		goto done;
149
+	}
150
+
144 151
 	/* Identify network-layer and link-layer protocols */
145 152
 	arp_net_protocol = arp_find_protocol ( arphdr->ar_pro );
146 153
 	if ( ! arp_net_protocol ) {

正在加载...
取消
保存