Commit message: CVE-2017-13041/ICMP6: Add more bounds checks.

This fixes a buffer over-read discovered by Kim Gwan Yeong.

Add a test using the capture file supplied by the reporter(s).
CVE: CVE-2017-13041
CWE: CWE-125
Vulnerability description: The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().

Project: tcpdump
File: print-icmp6.c

dnsname_print(netdissect_options *ndo, const u_char *cp, const u_char *ep)
{
	int i;

	/* DNS name decoding - no decompression */
	ND_PRINT((ndo,", \""));
	while (cp < ep) {
		i = *cp++;
		if (i) {
			if (i > ep - cp) {
				ND_PRINT((ndo,"???"));
				break;
			}
			while (i-- && cp < ep) {
				safeputchar(ndo, *cp);
				cp++;
			}
			if (cp + 1 < ep && *cp)
				ND_PRINT((ndo,"."));
		} else {
			if (cp == ep) {
				/* FQDN */
				ND_PRINT((ndo,"."));
			} else if (cp + 1 == ep && *cp == '\0') {
				/* truncated */
			} else {
				/* invalid */
				ND_PRINT((ndo,"???"));
			}
			break;
		}
	}
	ND_PRINT((ndo,"\""));
}

Project: tcpdump
File: print-icmp6.c

get_lifetime(uint32_t v)
{
	static char buf[20];

	if (v == (uint32_t)~0UL)
		return "infinity";
	else {
		snprintf(buf, sizeof(buf), "%us", v);
		return buf;
	}
}

Project: tcpdump
File: print-icmp6.c

get_rtpref(u_int v)
{
	static const char *rtpref_str[] = {
		"medium",		/* 00 */
		"high",			/* 01 */
		"rsv",			/* 10 */
		"low"			/* 11 */
	};

	return rtpref_str[((v & ND_RA_FLAG_RTPREF_MASK) >> 3) & 0xff];
}

Project: tcpdump
File: print-icmp6.c

get_upperlayer(netdissect_options *ndo, const u_char *bp, u_int *prot)
{
	const u_char *ep;
	const struct ip6_hdr *ip6 = (const struct ip6_hdr *)bp;
	const struct udphdr *uh;
	const struct ip6_hbh *hbh;
	const struct ip6_frag *fragh;
	const struct ah *ah;
	u_int nh;
	int hlen;

	/* 'ep' points to the end of available data. */
	ep = ndo->ndo_snapend;

	if (!ND_TTEST(ip6->ip6_nxt))
		return NULL;

	nh = ip6->ip6_nxt;
	hlen = sizeof(struct ip6_hdr);

	while (bp < ep) {
		bp += hlen;

		switch(nh) {
		case IPPROTO_UDP:
		case IPPROTO_TCP:
			uh = (const struct udphdr *)bp;
			if (ND_TTEST(uh->uh_dport)) {
				*prot = nh;
				return(uh);
			}
			else
				return(NULL);
			/* NOTREACHED */

		case IPPROTO_HOPOPTS:
		case IPPROTO_DSTOPTS:
		case IPPROTO_ROUTING:
			hbh = (const struct ip6_hbh *)bp;
			if (!ND_TTEST(hbh->ip6h_len))
				return(NULL);
			nh = hbh->ip6h_nxt;
			hlen = (hbh->ip6h_len + 1) << 3;
			break;

		case IPPROTO_FRAGMENT: /* this should be odd, but try anyway */
			fragh = (const struct ip6_frag *)bp;
			if (!ND_TTEST(fragh->ip6f_offlg))
				return(NULL);
			/* fragments with non-zero offset are meaningless */
			if ((EXTRACT_16BITS(&fragh->ip6f_offlg) & IP6F_OFF_MASK) != 0)
				return(NULL);
			nh = fragh->ip6f_nxt;
			hlen = sizeof(struct ip6_frag);
			break;

		case IPPROTO_AH:
			ah = (const struct ah *)bp;
			if (!ND_TTEST(ah->ah_len))
				return(NULL);
			nh = ah->ah_nxt;
			hlen = (ah->ah_len + 2) << 2;
			break;

		default:	/* unknown or undecodable header */
			*prot = nh; /* meaningless, but set here anyway */
			return(NULL);
		}
	}

	return(NULL);		/* should be notreached, though */
}

Project: tcpdump
File: print-icmp6.c

static int icmp6_cksum(netdissect_options *ndo, const struct ip6_hdr *ip6,
	const struct icmp6_hdr *icp, u_int len)
{
	return nextproto6_cksum(ndo, ip6, (const uint8_t *)(const void *)icp, len, len,
				IPPROTO_ICMPV6);
}

Project: tcpdump
File: print-icmp6.c

icmp6_print(netdissect_options *ndo,
            const u_char *bp, u_int length, const u_char *bp2, int fragmented)
{
	const struct icmp6_hdr *dp;
	const struct ip6_hdr *ip;
	const struct ip6_hdr *oip;
	const struct udphdr *ouh;
	int dport;
	const u_char *ep;
	u_int prot;

	dp = (const struct icmp6_hdr *)bp;
	ip = (const struct ip6_hdr *)bp2;
	oip = (const struct ip6_hdr *)(dp + 1);
	/* 'ep' points to the end of available data. */
	ep = ndo->ndo_snapend;

	ND_TCHECK(dp->icmp6_cksum);

	if (ndo->ndo_vflag && !fragmented) {
		uint16_t sum, udp_sum;

		if (ND_TTEST2(bp[0], length)) {
			udp_sum = EXTRACT_16BITS(&dp->icmp6_cksum);
			sum = icmp6_cksum(ndo, ip, dp, length);
			if (sum != 0)
				ND_PRINT((ndo,"[bad icmp6 cksum 0x%04x -> 0x%04x!] ",
                                                udp_sum,
                                                in_cksum_shouldbe(udp_sum, sum)));
			else
				ND_PRINT((ndo,"[icmp6 sum ok] "));
		}
	}

        ND_PRINT((ndo,"ICMP6, %s", tok2str(icmp6_type_values,"unknown icmp6 type (%u)",dp->icmp6_type)));

        /* display cosmetics: print the packet length for printer that use the vflag now */
        if (ndo->ndo_vflag && (dp->icmp6_type == ND_ROUTER_SOLICIT ||
                      dp->icmp6_type == ND_ROUTER_ADVERT ||
                      dp->icmp6_type == ND_NEIGHBOR_ADVERT ||
                      dp->icmp6_type == ND_NEIGHBOR_SOLICIT ||
                      dp->icmp6_type == ND_REDIRECT ||
                      dp->icmp6_type == ICMP6_HADISCOV_REPLY ||
                      dp->icmp6_type == ICMP6_MOBILEPREFIX_ADVERT ))
                ND_PRINT((ndo,", length %u", length));

	switch (dp->icmp6_type) {
	case ICMP6_DST_UNREACH:
		ND_TCHECK(oip->ip6_dst);
                ND_PRINT((ndo,", %s", tok2str(icmp6_dst_unreach_code_values,"unknown unreach code (%u)",dp->icmp6_code)));
		switch (dp->icmp6_code) {

		case ICMP6_DST_UNREACH_NOROUTE: /* fall through */
		case ICMP6_DST_UNREACH_ADMIN:
		case ICMP6_DST_UNREACH_ADDR:
                        ND_PRINT((ndo," %s",ip6addr_string(ndo, &oip->ip6_dst)));
                        break;
		case ICMP6_DST_UNREACH_BEYONDSCOPE:
			ND_PRINT((ndo," %s, source address %s",
			       ip6addr_string(ndo, &oip->ip6_dst),
                                  ip6addr_string(ndo, &oip->ip6_src)));
			break;
		case ICMP6_DST_UNREACH_NOPORT:
			if ((ouh = get_upperlayer(ndo, (const u_char *)oip, &prot))
			    == NULL)
				goto trunc;

			dport = EXTRACT_16BITS(&ouh->uh_dport);
			switch (prot) {
			case IPPROTO_TCP:
				ND_PRINT((ndo,", %s tcp port %s",
					ip6addr_string(ndo, &oip->ip6_dst),
                                          tcpport_string(ndo, dport)));
				break;
			case IPPROTO_UDP:
				ND_PRINT((ndo,", %s udp port %s",
					ip6addr_string(ndo, &oip->ip6_dst),
                                          udpport_string(ndo, dport)));
				break;
			default:
				ND_PRINT((ndo,", %s protocol %d port %d unreachable",
					ip6addr_string(ndo, &oip->ip6_dst),
                                          oip->ip6_nxt, dport));
				break;
			}
			break;
		default:
                  if (ndo->ndo_vflag <= 1) {
                    print_unknown_data(ndo, bp,"\n\t",length);
                    return;
                  }
                    break;
		}
		break;
	case ICMP6_PACKET_TOO_BIG:
		ND_TCHECK(dp->icmp6_mtu);
		ND_PRINT((ndo,", mtu %u", EXTRACT_32BITS(&dp->icmp6_mtu)));
		break;
	case ICMP6_TIME_EXCEEDED:
		ND_TCHECK(oip->ip6_dst);
		switch (dp->icmp6_code) {
		case ICMP6_TIME_EXCEED_TRANSIT:
			ND_PRINT((ndo," for %s",
                                  ip6addr_string(ndo, &oip->ip6_dst)));
			break;
		case ICMP6_TIME_EXCEED_REASSEMBLY:
			ND_PRINT((ndo," (reassembly)"));
			break;
		default:
                        ND_PRINT((ndo,", unknown code (%u)", dp->icmp6_code));
			break;
		}
		break;
	case ICMP6_PARAM_PROB:
		ND_TCHECK(oip->ip6_dst);
		switch (dp->icmp6_code) {
		case ICMP6_PARAMPROB_HEADER:
                        ND_PRINT((ndo,", erroneous - octet %u", EXTRACT_32BITS(&dp->icmp6_pptr)));
                        break;
		case ICMP6_PARAMPROB_NEXTHEADER:
                        ND_PRINT((ndo,", next header - octet %u", EXTRACT_32BITS(&dp->icmp6_pptr)));
                        break;
		case ICMP6_PARAMPROB_OPTION:
                        ND_PRINT((ndo,", option - octet %u", EXTRACT_32BITS(&dp->icmp6_pptr)));
                        break;
		default:
                        ND_PRINT((ndo,", code-#%d",
                                  dp->icmp6_code));
                        break;
		}
		break;
	case ICMP6_ECHO_REQUEST:
	case ICMP6_ECHO_REPLY:
                ND_TCHECK(dp->icmp6_seq);
                ND_PRINT((ndo,", seq %u", EXTRACT_16BITS(&dp->icmp6_seq)));
		break;
	case ICMP6_MEMBERSHIP_QUERY:
		if (length == MLD_MINLEN) {
			mld6_print(ndo, (const u_char *)dp);
		} else if (length >= MLDV2_MINLEN) {
			ND_PRINT((ndo," v2"));
			mldv2_query_print(ndo, (const u_char *)dp, length);
		} else {
                        ND_PRINT((ndo," unknown-version (len %u) ", length));
		}
		break;
	case ICMP6_MEMBERSHIP_REPORT:
		mld6_print(ndo, (const u_char *)dp);
		break;
	case ICMP6_MEMBERSHIP_REDUCTION:
		mld6_print(ndo, (const u_char *)dp);
		break;
	case ND_ROUTER_SOLICIT:
#define RTSOLLEN 8
		if (ndo->ndo_vflag) {
			icmp6_opt_print(ndo, (const u_char *)dp + RTSOLLEN,
					length - RTSOLLEN);
		}
		break;
	case ND_ROUTER_ADVERT:
#define RTADVLEN 16
		if (ndo->ndo_vflag) {
			const struct nd_router_advert *p;

			p = (const struct nd_router_advert *)dp;
			ND_TCHECK(p->nd_ra_retransmit);
			ND_PRINT((ndo,"\n\thop limit %u, Flags [%s]" \
                                  ", pref %s, router lifetime %us, reachable time %us, retrans time %us",
                                  (u_int)p->nd_ra_curhoplimit,
                                  bittok2str(icmp6_opt_ra_flag_values,"none",(p->nd_ra_flags_reserved)),
                                  get_rtpref(p->nd_ra_flags_reserved),
                                  EXTRACT_16BITS(&p->nd_ra_router_lifetime),
                                  EXTRACT_32BITS(&p->nd_ra_reachable),
                                  EXTRACT_32BITS(&p->nd_ra_retransmit)));

			icmp6_opt_print(ndo, (const u_char *)dp + RTADVLEN,
					length - RTADVLEN);
		}
		break;
	case ND_NEIGHBOR_SOLICIT:
	    {
		const struct nd_neighbor_solicit *p;
		p = (const struct nd_neighbor_solicit *)dp;
		ND_TCHECK(p->nd_ns_target);
		ND_PRINT((ndo,", who has %s", ip6addr_string(ndo, &p->nd_ns_target)));
		if (ndo->ndo_vflag) {
#define NDSOLLEN 24
			icmp6_opt_print(ndo, (const u_char *)dp + NDSOLLEN,
					length - NDSOLLEN);
		}
	    }
		break;
	case ND_NEIGHBOR_ADVERT:
	    {
		const struct nd_neighbor_advert *p;

		p = (const struct nd_neighbor_advert *)dp;
		ND_TCHECK(p->nd_na_target);
		ND_PRINT((ndo,", tgt is %s",
                          ip6addr_string(ndo, &p->nd_na_target)));
		if (ndo->ndo_vflag) {
                        ND_PRINT((ndo,", Flags [%s]",
                                  bittok2str(icmp6_nd_na_flag_values,
                                             "none",
                                             EXTRACT_32BITS(&p->nd_na_flags_reserved))));
#define NDADVLEN 24
			icmp6_opt_print(ndo, (const u_char *)dp + NDADVLEN,
					length - NDADVLEN);
#undef NDADVLEN
		}
	    }
		break;
	case ND_REDIRECT:
#define RDR(i) ((const struct nd_redirect *)(i))
                         ND_TCHECK(RDR(dp)->nd_rd_dst);
                         ND_PRINT((ndo,", %s", ip6addr_string(ndo, &RDR(dp)->nd_rd_dst)));
		ND_TCHECK(RDR(dp)->nd_rd_target);
		ND_PRINT((ndo," to %s",
                          ip6addr_string(ndo, &RDR(dp)->nd_rd_target)));
#define REDIRECTLEN 40
		if (ndo->ndo_vflag) {
			icmp6_opt_print(ndo, (const u_char *)dp + REDIRECTLEN,
					length - REDIRECTLEN);
		}
		break;
#undef REDIRECTLEN
#undef RDR
	case ICMP6_ROUTER_RENUMBERING:
		icmp6_rrenum_print(ndo, bp, ep);
		break;
	case ICMP6_NI_QUERY:
	case ICMP6_NI_REPLY:
		icmp6_nodeinfo_print(ndo, length, bp, ep);
		break;
	case IND_SOLICIT:
	case IND_ADVERT:
		break;
	case ICMP6_V2_MEMBERSHIP_REPORT:
		mldv2_report_print(ndo, (const u_char *) dp, length);
		break;
	case ICMP6_MOBILEPREFIX_SOLICIT: /* fall through */
	case ICMP6_HADISCOV_REQUEST:
                ND_TCHECK(dp->icmp6_data16[0]);
                ND_PRINT((ndo,", id 0x%04x", EXTRACT_16BITS(&dp->icmp6_data16[0])));
                break;
	case ICMP6_HADISCOV_REPLY:
		if (ndo->ndo_vflag) {
			const struct in6_addr *in6;
			const u_char *cp;

			ND_TCHECK(dp->icmp6_data16[0]);
			ND_PRINT((ndo,", id 0x%04x", EXTRACT_16BITS(&dp->icmp6_data16[0])));
			cp = (const u_char *)dp + length;
			in6 = (const struct in6_addr *)(dp + 1);
			for (; (const u_char *)in6 < cp; in6++) {
				ND_TCHECK(*in6);
				ND_PRINT((ndo,", %s", ip6addr_string(ndo, in6)));
			}
		}
		break;
	case ICMP6_MOBILEPREFIX_ADVERT:
		if (ndo->ndo_vflag) {
			ND_TCHECK(dp->icmp6_data16[0]);
			ND_PRINT((ndo,", id 0x%04x", EXTRACT_16BITS(&dp->icmp6_data16[0])));
			ND_TCHECK(dp->icmp6_data16[1]);
			if (dp->icmp6_data16[1] & 0xc0)
				ND_PRINT((ndo," "));
			if (dp->icmp6_data16[1] & 0x80)
				ND_PRINT((ndo,"M"));
			if (dp->icmp6_data16[1] & 0x40)
				ND_PRINT((ndo,"O"));
#define MPADVLEN 8
			icmp6_opt_print(ndo, (const u_char *)dp + MPADVLEN,
					length - MPADVLEN);
		}
		break;
        case ND_RPL_MESSAGE:
                /* plus 4, because struct icmp6_hdr contains 4 bytes of icmp payload */
                rpl_print(ndo, dp, &dp->icmp6_data8[0], length-sizeof(struct icmp6_hdr)+4);
                break;
	default:
                ND_PRINT((ndo,", length %u", length));
                if (ndo->ndo_vflag <= 1)
                        print_unknown_data(ndo, bp,"\n\t", length);
                return;
        }
        if (!ndo->ndo_vflag)
                ND_PRINT((ndo,", length %u", length));
	return;
trunc:
	ND_PRINT((ndo, "[|icmp6]"));
}

Project: tcpdump
File: print-icmp6.c

mld6_print(netdissect_options *ndo, const u_char *bp)
{
	const struct mld6_hdr *mp = (const struct mld6_hdr *)bp;
	const u_char *ep;

	/* 'ep' points to the end of available data. */
	ep = ndo->ndo_snapend;

	if ((const u_char *)mp + sizeof(*mp) > ep)
		return;

	ND_PRINT((ndo,"max resp delay: %d ", EXTRACT_16BITS(&mp->mld6_maxdelay)));
	ND_PRINT((ndo,"addr: %s", ip6addr_string(ndo, &mp->mld6_addr)));
}

Project: tcpdump
File: print-icmp6.c

print_lladdr(netdissect_options *ndo, const uint8_t *p, size_t l)
{
	const uint8_t *ep, *q;

	q = p;
	ep = p + l;
	while (l > 0 && q < ep) {
		if (q > p)
                        ND_PRINT((ndo,":"));
		ND_PRINT((ndo,"%02x", *q++));
		l--;
	}
}