CVE-2018-14938: Out-of-bounds Read (CWE-125)
value: An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144, one can cause an integer overflow in the function handle_80211, which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2018-08-05T03:29Z
Repository: https://github.com/simsong/tcpflow
Language: C++
Files changed: src/wifipcap/wifipcap.cpp
Commit date: 2018-08-02 21:33:09 -0400
Commit message: fixed buffer overflow

Diff: diff --git a/src/wifipcap/wifipcap.cpp b/src/wifipcap/wifipcap.cpp
index ef47ccf..5e45cdb 100644
--- a/src/wifipcap/wifipcap.cpp
+++ b/src/wifipcap/wifipcap.cpp
@@ -1490,29 +1490,32 @@ done:;
 void WifiPacket::handle_prism(const u_char *pc, size_t len)
 {
     prism2_pkthdr hdr;
 
     /* get the fields */
-    hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
-    hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
-    hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
-    hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
-    hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
-    hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
-    hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
-    hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
-    hdr.istx		= EXTRACT_LE_32BITS(pc+128);
-    cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
-    handle_80211(pc+144,len-144);
+    if (len>=144){
+        hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
+        hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
+        hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
+        hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
+        hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
+        hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
+        hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
+        hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
+        hdr.istx		= EXTRACT_LE_32BITS(pc+128);
+        cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
+        handle_80211(pc+144,len-144);
+    }
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 ///
 /// handle_*:
 /// handle each of the packet types
 ///
 
+/// 2018-08-02: slg - I'm not sure why this is commented out.
 void WifiPacket::handle_ether(const u_char *ptr, size_t len)
 {
 #if 0
     ether_hdr_t hdr;
 
@@ -1713,10 +1716,11 @@ void Wifipcap::handle_packet(WifipcapCallbacks *cbs,int header_type,
     case DLT_EN10MB:
         pkt.handle_ether(packet,header->caplen);
         break;
     default:
 #if 0
+        /// 2018-08-02: slg - I'm also not sure why this is commented out.
 	// try handling it as default IP assuming framing is ethernet 
 	// (this is for testing)
         pkt.handle_ip(packet,header->caplen);
 #endif
         break;

Vulnerable code:     hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
    hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
    hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
    hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
    hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
    hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
    hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
    hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
    hdr.istx		= EXTRACT_LE_32BITS(pc+128);
    cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
    handle_80211(pc+144,len-144);
Fixed code:     if (len>=144){
        hdr.host_time 	= EXTRACT_LE_32BITS(pc+32);
        hdr.mac_time 	= EXTRACT_LE_32BITS(pc+44);
        hdr.channel 	= EXTRACT_LE_32BITS(pc+56);
        hdr.rssi 		= EXTRACT_LE_32BITS(pc+68);
        hdr.sq 		= EXTRACT_LE_32BITS(pc+80);
        hdr.signal  	= EXTRACT_LE_32BITS(pc+92);
        hdr.noise   	= EXTRACT_LE_32BITS(pc+104);
        hdr.rate		= EXTRACT_LE_32BITS(pc+116)/2;
        hdr.istx		= EXTRACT_LE_32BITS(pc+128);
        cbs->HandlePrism( *this, &hdr, pc + 144, len - 144);
        handle_80211(pc+144,len-144);
    }
/// 2018-08-02: slg - I'm not sure why this is commented out.
        /// 2018-08-02: slg - I'm also not sure why this is commented out.