rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.
Vulnerability ID: CVE-2016-4485
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-05-23
File: net/llc/af_llc.c
Commit message: net: fix infoleak in llc

The stack object “info” has a total size of 12 bytes. Its last byte
is padding which is not initialized and leaked via “put_cmsg”.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Kangjie Lu

Vulnerable version (before fix):
 static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb) 	if (llc->cmsg_flags & LLC_CMSG_PKTINFO) { 		struct llc_pktinfo info;  		info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex; 		llc_pdu_decode_dsap(skb, &info.lpi_sap); 		llc_pdu_decode_da(skb, info.lpi_mac);

Fixed version (after fix):
 static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb) 	if (llc->cmsg_flags & LLC_CMSG_PKTINFO) { 		struct llc_pktinfo info;  		memset(&info, 0, sizeof(info)); 		info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex; 		llc_pdu_decode_dsap(skb, &info.lpi_sap); 		llc_pdu_decode_da(skb, info.lpi_mac);

Patch:
patch: @@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
 	if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
 		struct llc_pktinfo info;
 
+		memset(&info, 0, sizeof(info));
 		info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
 		llc_pdu_decode_dsap(skb, &info.lpi_sap);
 		llc_pdu_decode_da(skb, info.lpi_mac);
path: net/llc/af_llc.c
Vulnerability: The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.
Vulnerability ID: CVE-2016-4486
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-05-23
File: net/core/rtnetlink.c
Commit message: net: fix infoleak in rtnetlink

The stack object “map” has a total size of 32 bytes. Its last 4
bytes are padding generated by compiler. These padding bytes are
not initialized and sent out via “nla_put”.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Kangjie Lu

Vulnerable version (before fix):
 static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,  static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev) { 	struct rtnl_link_ifmap map = { 		.mem_start   = dev->mem_start, 		.mem_end     = dev->mem_end, 		.base_addr   = dev->base_addr, 		.irq         = dev->irq, 		.dma         = dev->dma, 		.port        = dev->if_port, 	}; 	if (nla_put(skb, IFLA_MAP, sizeof(map), &map)) 		return -EMSGSIZE; 

Fixed version (after fix):
 static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,  static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev) { 	struct rtnl_link_ifmap map;  	memset(&map, 0, sizeof(map)); 	map.mem_start   = dev->mem_start; 	map.mem_end     = dev->mem_end; 	map.base_addr   = dev->base_addr; 	map.irq         = dev->irq; 	map.dma         = dev->dma; 	map.port        = dev->if_port;  	if (nla_put(skb, IFLA_MAP, sizeof(map), &map)) 		return -EMSGSIZE; 

Patch:
patch: @@ -1180,14 +1180,16 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
 
 static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev)
 {
-	struct rtnl_link_ifmap map = {
-		.mem_start   = dev->mem_start,
-		.mem_end     = dev->mem_end,
-		.base_addr   = dev->base_addr,
-		.irq         = dev->irq,
-		.dma         = dev->dma,
-		.port        = dev->if_port,
-	};
+	struct rtnl_link_ifmap map;
+
+	memset(&map, 0, sizeof(map));
+	map.mem_start   = dev->mem_start;
+	map.mem_end     = dev->mem_end;
+	map.base_addr   = dev->base_addr;
+	map.irq         = dev->irq;
+	map.dma         = dev->dma;
+	map.port        = dev->if_port;
+
 	if (nla_put(skb, IFLA_MAP, sizeof(map), &map))
 		return -EMSGSIZE;
path: net/core/rtnetlink.c
Vulnerability: The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.
Vulnerability ID: CVE-2016-4569
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-05-23
File: sound/core/timer.c
Commit message: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS

The stack object “tread” has a total size of 32 bytes. Its field
“event” and “val” both contain 4 bytes padding. These 8 bytes
padding bytes are sent to user without being initialized.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Commit author: Kangjie Lu

Vulnerable version (before fix):
 static int snd_timer_user_params(struct file *file, 	if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) { 		if (tu->tread) { 			struct snd_timer_tread tread; 			tread.event = SNDRV_TIMER_EVENT_EARLY; 			tread.tstamp.tv_sec = 0; 			tread.tstamp.tv_nsec = 0;

Fixed version (after fix):
 static int snd_timer_user_params(struct file *file, 	if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) { 		if (tu->tread) { 			struct snd_timer_tread tread; 			memset(&tread, 0, sizeof(tread)); 			tread.event = SNDRV_TIMER_EVENT_EARLY; 			tread.tstamp.tv_sec = 0; 			tread.tstamp.tv_nsec = 0;

Patch:
patch: @@ -1737,6 +1737,7 @@ static int snd_timer_user_params(struct file *file,
 	if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) {
 		if (tu->tread) {
 			struct snd_timer_tread tread;
+			memset(&tread, 0, sizeof(tread));
 			tread.event = SNDRV_TIMER_EVENT_EARLY;
 			tread.tstamp.tv_sec = 0;
 			tread.tstamp.tv_nsec = 0;
path: sound/core/timer.c
Vulnerability: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.
Vulnerability ID: CVE-2016-4580
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-05-23
File: net/x25/x25_facilities.c
Commit message: net: fix a kernel infoleak in x25 module

Stack object "dte_facilities" is allocated in x25_rx_call_request(),
which is supposed to be initialized in x25_negotiate_facilities.
However, 5 fields (8 bytes in total) are not initialized. This
object is then copied to userland via copy_to_user, thus infoleak
occurs.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Kangjie Lu

Vulnerable version (before fix):
 int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,  	memset(&theirs, 0, sizeof(theirs)); 	memcpy(new, ours, sizeof(*new));  	len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask); 	if (len < 0)

Fixed version (after fix):
 int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,  	memset(&theirs, 0, sizeof(theirs)); 	memcpy(new, ours, sizeof(*new)); 	memset(dte, 0, sizeof(*dte));  	len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask); 	if (len < 0)

Patch:
patch: @@ -277,6 +277,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
 
 	memset(&theirs, 0, sizeof(theirs));
 	memcpy(new, ours, sizeof(*new));
+	memset(dte, 0, sizeof(*dte));
 
 	len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
 	if (len < 0)
path: net/x25/x25_facilities.c
Vulnerability: The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.
Vulnerability ID: CVE-2016-4809
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2016-09-21
File: libarchive/archive_read_support_format_cpio.c
Commit message: Reject cpio symlinks that exceed 1MB
Commit author: Tim Kientzle

Vulnerable version (before fix):
 archive_read_format_cpio_read_header(struct archive_read *a,  	/* If this is a symlink, read the link contents. */ 	if (archive_entry_filetype(entry) == AE_IFLNK) { 		h = __archive_read_ahead(a, 			(size_t)cpio->entry_bytes_remaining, NULL); 		if (h == NULL)

Fixed version (after fix):
 archive_read_format_cpio_read_header(struct archive_read *a,  	/* If this is a symlink, read the link contents. */ 	if (archive_entry_filetype(entry) == AE_IFLNK) { 		if (cpio->entry_bytes_remaining > 1024 * 1024) { 			archive_set_error(&a->archive, ENOMEM, 			    "Rejecting malformed cpio archive: symlink contents exceed 1 megabyte"); 			return (ARCHIVE_FATAL); 		} 		h = __archive_read_ahead(a, 			(size_t)cpio->entry_bytes_remaining, NULL); 		if (h == NULL)

Patch:
patch: @@ -401,6 +401,11 @@ archive_read_format_cpio_read_header(struct archive_read *a,
 
 	/* If this is a symlink, read the link contents. */
 	if (archive_entry_filetype(entry) == AE_IFLNK) {
+		if (cpio->entry_bytes_remaining > 1024 * 1024) {
+			archive_set_error(&a->archive, ENOMEM,
+			    "Rejecting malformed cpio archive: symlink contents exceed 1 megabyte");
+			return (ARCHIVE_FATAL);
+		}
 		h = __archive_read_ahead(a,
 			(size_t)cpio->entry_bytes_remaining, NULL);
 		if (h == NULL)
path: libarchive/archive_read_support_format_cpio.c
Vulnerability: Directory traversal vulnerability in libraries/error_report.lib.php in phpMyAdmin before 4.6.2-prerelease allows remote attackers to determine the existence of arbitrary files by triggering an error.
Vulnerability ID: CVE-2016-5098
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2016-07-05
File: libraries/error_report.lib.php
Commit message: Fix possible path existence disclossure

On non released versions (where line counts are not precalculated) it
was possible to check for file existence due to limited checks for
supplied path.

Signed-off-by: Michal Čihař <michal@cihar.com>
Commit author: Michal Čihař

Vulnerable version (before fix):
 function PMA_countLines($filename)     foreach (explode('/', $filename) as $part) {         if ($part == '..') {             $depath--;         } elseif ($part != '.') {             $depath++;         }         if ($depath < 0) {

Fixed version (after fix):
 function PMA_countLines($filename)     foreach (explode('/', $filename) as $part) {         if ($part == '..') {             $depath--;         } elseif ($part != '.' || $part === '') {             $depath++;         }         if ($depath < 0) {

Patch:
patch: @@ -238,7 +238,7 @@ function PMA_countLines($filename)
     foreach (explode('/', $filename) as $part) {
         if ($part == '..') {
             $depath--;
-        } elseif ($part != '.') {
+        } elseif ($part != '.' || $part === '') {
             $depath++;
         }
         if ($depath < 0) {
path: libraries/error_report.lib.php
Vulnerability: sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging.
Vulnerability ID: CVE-2016-5114
CWE: CWE-125
Severity score: 4.9
Project: http://github.com/php/php-src
Published: 2016-08-07
File: sapi/fpm/fpm/fpm_log.c
Commit message: Fixed bug #70755: fpm_log.c memory leak and buffer overflow
Commit author: Stanislav Malyshev

Vulnerable version (before fix):
 int fpm_log_write(char *log_format) /* {{{ */ 				b += len2; 				len += len2; 			} 			continue; 		} 

Fixed version (after fix):
 int fpm_log_write(char *log_format) /* {{{ */ 				b += len2; 				len += len2; 			} 			if (len >= FPM_LOG_BUFFER) { 				zlog(ZLOG_NOTICE, "the log buffer is full (%d). The access log request has been truncated.", FPM_LOG_BUFFER); 				len = FPM_LOG_BUFFER; 				break; 			} 			continue; 		} 

Patch:
patch: @@ -448,6 +448,11 @@ int fpm_log_write(char *log_format) /* {{{ */
 				b += len2;
 				len += len2;
 			}
+			if (len >= FPM_LOG_BUFFER) {
+				zlog(ZLOG_NOTICE, "the log buffer is full (%d). The access log request has been truncated.", FPM_LOG_BUFFER);
+				len = FPM_LOG_BUFFER;
+				break;
+			}
 			continue;
 		}
path: sapi/fpm/fpm/fpm_log.c
Vulnerability: sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging.
Vulnerability ID: CVE-2016-5114
CWE: CWE-119
Severity score: 4.9
Project: http://github.com/php/php-src
Published: 2016-08-07
File: sapi/fpm/fpm/fpm_log.c
Commit message: Fixed bug #70755: fpm_log.c memory leak and buffer overflow
Commit author: Stanislav Malyshev

Vulnerable version (before fix):
 int fpm_log_write(char *log_format) /* {{{ */ 				b += len2; 				len += len2; 			} 			continue; 		} 

Fixed version (after fix):
 int fpm_log_write(char *log_format) /* {{{ */ 				b += len2; 				len += len2; 			} 			if (len >= FPM_LOG_BUFFER) { 				zlog(ZLOG_NOTICE, "the log buffer is full (%d). The access log request has been truncated.", FPM_LOG_BUFFER); 				len = FPM_LOG_BUFFER; 				break; 			} 			continue; 		} 

Patch:
patch: @@ -448,6 +448,11 @@ int fpm_log_write(char *log_format) /* {{{ */
 				b += len2;
 				len += len2;
 			}
+			if (len >= FPM_LOG_BUFFER) {
+				zlog(ZLOG_NOTICE, "the log buffer is full (%d). The access log request has been truncated.", FPM_LOG_BUFFER);
+				len = FPM_LOG_BUFFER;
+				break;
+			}
 			continue;
 		}
path: sapi/fpm/fpm/fpm_log.c
Vulnerability: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.
Vulnerability ID: CVE-2016-5243
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-06-27
File: net/tipc/netlink_compat.c
Commit message: tipc: fix an infoleak in tipc_nl_compat_link_dump

link_info.str is a char array of size 60. Memory after the NULL
byte is not initialized. Sending the whole object out can cause
a leak.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Kangjie Lu

Vulnerable version (before fix):
 static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,  	link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]); 	link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP])); 	strcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]));  	return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO, 			    &link_info, sizeof(link_info));

Fixed version (after fix):
 static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,  	link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]); 	link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP])); 	nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]), 		    TIPC_MAX_LINK_NAME);  	return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO, 			    &link_info, sizeof(link_info));

Patch:
patch: @@ -604,7 +604,8 @@ static int tipc_nl_compat_link_dump(struct tipc_nl_compat_msg *msg,
 
 	link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]);
 	link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP]));
-	strcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]));
+	nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]),
+		    TIPC_MAX_LINK_NAME);
 
 	return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO,
 			    &link_info, sizeof(link_info));
path: net/tipc/netlink_compat.c
Vulnerability: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.
Vulnerability ID: CVE-2016-5244
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-06-27
File: net/rds/recv.c
Commit message: rds: fix an infoleak in rds_inc_info_copy

The last field "flags" of object "minfo" is not initialized.
Copying this object out may leak kernel stack data.
Assign 0 to it to avoid leak.

Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Kangjie Lu

Vulnerable version (before fix):
 void rds_inc_info_copy(struct rds_incoming *inc, 		minfo.fport = inc->i_hdr.h_dport; 	}  	rds_info_copy(iter, &minfo, sizeof(minfo)); }

Fixed version (after fix):
 void rds_inc_info_copy(struct rds_incoming *inc, 		minfo.fport = inc->i_hdr.h_dport; 	}  	minfo.flags = 0;  	rds_info_copy(iter, &minfo, sizeof(minfo)); }

Patch:
patch: @@ -561,5 +561,7 @@ void rds_inc_info_copy(struct rds_incoming *inc,
 		minfo.fport = inc->i_hdr.h_dport;
 	}
 
+	minfo.flags = 0;
+
 	rds_info_copy(iter, &minfo, sizeof(minfo));
 }
path: net/rds/recv.c
Vulnerability: epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Vulnerability ID: CVE-2016-5350
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/wireshark/wireshark
Published: 2016-08-07
File: epan/dissectors/packet-dcerpc-spoolss.c
Commit message: SPOOLSS: Try to avoid an infinite loop.

Use tvb_reported_length_remaining in dissect_spoolss_uint16uni. Make
sure our offset always increments in dissect_spoolss_keybuffer.

Change-Id: I7017c9685bb2fa27161d80a03b8fca4ef630e793
Reviewed-on: https://code.wireshark.org/review/14687
Reviewed-by: Gerald Combs <gerald@wireshark.org>
Petri-Dish: Gerald Combs <gerald@wireshark.org>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
Commit author: Gerald Combs

Vulnerable version (before fix):
 dissect_spoolss_uint16uni(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,  	/* Get remaining data in buffer as a string */  	remaining = tvb_captured_length_remaining(tvb, offset); 	if (remaining <= 0) { 		if (data) 			*data = g_strdup(""); dissect_spoolss_keybuffer(tvbuff_t *tvb, int offset, packet_info *pinfo, 		end_offset = tvb_reported_length_remaining(tvb, offset) + 1; 	}  	while (offset < end_offset) 		offset = dissect_spoolss_uint16uni( 			tvb, offset, pinfo, tree, drep, NULL, hf_keybuffer);  	return offset; }

Fixed version (after fix):
 dissect_spoolss_uint16uni(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,  	/* Get remaining data in buffer as a string */  	remaining = tvb_reported_length_remaining(tvb, offset); 	if (remaining <= 0) { 		if (data) 			*data = g_strdup(""); dissect_spoolss_keybuffer(tvbuff_t *tvb, int offset, packet_info *pinfo, 		end_offset = tvb_reported_length_remaining(tvb, offset) + 1; 	}  	while (offset > 0 && offset < end_offset) { 		offset = dissect_spoolss_uint16uni( 			tvb, offset, pinfo, tree, drep, NULL, hf_keybuffer); 	}  	return offset; }

Patch:
patch: @@ -1090,7 +1090,7 @@ dissect_spoolss_uint16uni(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
 
 	/* Get remaining data in buffer as a string */
 
-	remaining = tvb_captured_length_remaining(tvb, offset);
+	remaining = tvb_reported_length_remaining(tvb, offset);
 	if (remaining <= 0) {
 		if (data)
 			*data = g_strdup("");
@@ -6198,9 +6198,10 @@ dissect_spoolss_keybuffer(tvbuff_t *tvb, int offset, packet_info *pinfo,
 		end_offset = tvb_reported_length_remaining(tvb, offset) + 1;
 	}
 
-	while (offset < end_offset)
+	while (offset > 0 && offset < end_offset) {
 		offset = dissect_spoolss_uint16uni(
 			tvb, offset, pinfo, tree, drep, NULL, hf_keybuffer);
+	}
 
 	return offset;
 }
path: epan/dissectors/packet-dcerpc-spoolss.c
Vulnerability: epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles the lack of an EAPOL_RSN_KEY, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Vulnerability ID: CVE-2016-5351
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/wireshark/wireshark
Published: 2016-08-07
File: epan/crypt/airpdcap.c
Commit message: Make sure EAPOL body is big enough for a EAPOL_RSN_KEY.

A pointer to a EAPOL_RSN_KEY is set on the packet presuming the
whole EAPOL_RSN_KEY is there.  That's not always the case for
fuzzed/malicious captures.

Bug: 11585
Change-Id: Ib94b8aceef444c7820e43b969596efdb8dbecccd
Reviewed-on: https://code.wireshark.org/review/15540
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
Commit author: Michael Mann

Vulnerable version (before fix):
 static INT AirPDcapScanForKeys(          /* get and check the body length (IEEE 802.1X-2004, pg. 25) */         bodyLength=pntoh16(data+offset+2);         if ((tot_len-offset-4) < bodyLength) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */             AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapScanForKeys", "EAPOL body too short", AIRPDCAP_DEBUG_LEVEL_3);             return AIRPDCAP_RET_NO_VALID_HANDSHAKE;         }

Fixed version (after fix):
 static INT AirPDcapScanForKeys(          /* get and check the body length (IEEE 802.1X-2004, pg. 25) */         bodyLength=pntoh16(data+offset+2);         if (((tot_len-offset-4) < bodyLength) || (bodyLength < sizeof(EAPOL_RSN_KEY))) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */             AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapScanForKeys", "EAPOL body too short", AIRPDCAP_DEBUG_LEVEL_3);             return AIRPDCAP_RET_NO_VALID_HANDSHAKE;         }

Patch:
patch: @@ -571,7 +571,7 @@ static INT AirPDcapScanForKeys(
 
         /* get and check the body length (IEEE 802.1X-2004, pg. 25) */
         bodyLength=pntoh16(data+offset+2);
-        if ((tot_len-offset-4) < bodyLength) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */
+        if (((tot_len-offset-4) < bodyLength) || (bodyLength < sizeof(EAPOL_RSN_KEY))) { /* Only check if frame is long enough for eapol header, ignore tailing garbage, see bug 9065 */
             AIRPDCAP_DEBUG_PRINT_LINE("AirPDcapScanForKeys", "EAPOL body too short", AIRPDCAP_DEBUG_LEVEL_3);
             return AIRPDCAP_RET_NO_VALID_HANDSHAKE;
         }
path: epan/crypt/airpdcap.c