CVE-2018-14938: Integer Overflow or Wraparound (CWE-190)
value: An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144, one can cause an integer overflow in the function handle_80211, which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.1
Published: 2018-08-05T03:29Z
Repository: https://github.com/simsong/tcpflow
Language: C++
Files changed: src/wifipcap/wifipcap.cpp
Commit date: 2018-08-02 21:33:09 -0400
Commit message: fixed buffer overflow

Diff: diff --git a/src/wifipcap/wifipcap.cpp b/src/wifipcap/wifipcap.cpp
index ef47ccf..5e45cdb 100644
--- a/src/wifipcap/wifipcap.cpp
+++ b/src/wifipcap/wifipcap.cpp
@@ -1490,29 +1490,32 @@ done:;
 void WifiPacket::handle_prism(const u_char *pc, size_t len)
 {
     prism2_pkthdr hdr;
 
     /* get the fields */
-    hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
-    hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
-    hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
-    hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
-    hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
-    hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
-    hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
-    hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
-    hdr.istx		= EXTRACT_LE_32BITS(pc+128);
-    cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
-    handle_80211(pc+144,len-144);
+    if (len>=144){
+        hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
+        hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
+        hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
+        hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
+        hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
+        hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
+        hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
+        hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
+        hdr.istx		= EXTRACT_LE_32BITS(pc+128);
+        cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
+        handle_80211(pc+144,len-144);
+    }
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 ///
 /// handle_*:
 /// handle each of the packet types
 ///
 
+/// 2018-08-02: slg - I'm not sure why this is commented out.
 void WifiPacket::handle_ether(const u_char *ptr, size_t len)
 {
 #if 0
     ether_hdr_t hdr;
 
@@ -1713,10 +1716,11 @@ void Wifipcap::handle_packet(WifipcapCallbacks *cbs,int header_type,
     case DLT_EN10MB:
         pkt.handle_ether(packet,header->caplen);
         break;
     default:
 #if 0
+        /// 2018-08-02: slg - I'm also not sure why this is commented out.
 	// try handling it as default IP assuming framing is ethernet 
 	// (this is for testing)
         pkt.handle_ip(packet,header->caplen);
 #endif
         break;

Vulnerable code:     hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
    hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
    hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
    hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
    hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
    hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
    hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
    hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
    hdr.istx		= EXTRACT_LE_32BITS(pc+128);
    cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
    handle_80211(pc+144,len-144);
Fixed code:     if (len>=144){
        hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
        hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
        hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
        hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
        hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
        hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
        hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
        hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
        hdr.istx		= EXTRACT_LE_32BITS(pc+128);
        cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
        handle_80211(pc+144,len-144);
    }
/// 2018-08-02: slg - I'm not sure why this is commented out.
        /// 2018-08-02: slg - I'm also not sure why this is commented out.