1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
From 39db474f80af87449ce0f034522dccc80ed4153f Mon Sep 17 00:00:00 2001
From: John Thacker <johnthacker@gmail.com>
Date: Thu, 1 Dec 2022 20:46:15 -0500
Subject: [PATCH] openflow_v6: Prevent infinite loops in too short ofp_stats
The ofp_stats struct length field includes the fixed 4 bytes.
If the length is smaller than that, report the length error
and break out. In particular, a value of zero can cause
infinite loops if this isn't done.
(cherry picked from commit 13823bb1059cf70f401892ba1b1eaa2400cdf3db)
Upstream-Status: Backport [https://gitlab.com/wireshark/wireshark/-/commit/39db474f80af87449ce0f034522dccc80ed4153f]
CVE: CVE-2022-4345
Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
---
epan/dissectors/packet-openflow_v6.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/epan/dissectors/packet-openflow_v6.c b/epan/dissectors/packet-openflow_v6.c
index 16016af..3e24d76 100644
--- a/epan/dissectors/packet-openflow_v6.c
+++ b/epan/dissectors/packet-openflow_v6.c
@@ -1118,17 +1118,23 @@ dissect_openflow_v6_oxs(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree,
static int
dissect_openflow_stats_v6(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, guint16 length _U_)
{
+ proto_item *ti;
guint32 stats_length;
int oxs_end;
guint32 padding;
proto_tree_add_item(tree, hf_openflow_v6_stats_reserved, tvb, offset, 2, ENC_NA);
- proto_tree_add_item_ret_uint(tree, hf_openflow_v6_stats_length, tvb, offset+2, 2, ENC_BIG_ENDIAN, &stats_length);
+ ti = proto_tree_add_item_ret_uint(tree, hf_openflow_v6_stats_length, tvb, offset+2, 2, ENC_BIG_ENDIAN, &stats_length);
oxs_end = offset + stats_length;
offset+=4;
+ if (stats_length < 4) {
+ expert_add_info(pinfo, ti, &ei_openflow_v6_length_too_short);
+ return offset;
+ }
+
while (offset < oxs_end) {
offset = dissect_openflow_v6_oxs(tvb, pinfo, tree, offset, oxs_end - offset);
}
--
2.40.1
|
