diff options
| author | Luca Deri <lucaderi@users.noreply.github.com> | 2020-03-12 18:13:30 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-03-12 18:13:30 +0100 |
| commit | 70ee793ff3dac24af0d0526cc40ff3639fa3feed (patch) | |
| tree | 98d9edf7d15895b694f4752615c5aee617df9945 /src/lib/protocols/tls.c | |
| parent | 1e933e8b026f6f88f27d64ec2260013f38d268d0 (diff) | |
| parent | 7806eb5f5b02fd78de1db20caeebc56088ebec3e (diff) | |
Merge pull request #856 from catenacyber/fuzzfix5
Fuzzfix5
Diffstat (limited to 'src/lib/protocols/tls.c')
| -rw-r--r-- | src/lib/protocols/tls.c | 19 |
1 files changed, 10 insertions, 9 deletions
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index 970f114cc..8c351053a 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -825,7 +825,7 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, } rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, ","); - if(rc > 0) ja3_str_len += rc; + if(rc > 0 && ja3_str_len + rc < JA3_STR_LEN) ja3_str_len += rc; /* ********** */ @@ -1113,7 +1113,8 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, s_offset++; - for(j=0; j<version_len; j += 2) { + // careful not to overflow and loop forever with u_int8_t + for(j=0; j+1<version_len; j += 2) { u_int16_t tls_version = ntohs(*((u_int16_t*)&packet->payload[s_offset+j])); u_int8_t unknown_tls_version; @@ -1155,38 +1156,38 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, for(i=0; i<ja3.num_cipher; i++) { rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, "%s%u", (i > 0) ? "-" : "", ja3.cipher[i]); - if(rc > 0) ja3_str_len += rc; else break; + if(rc > 0 && ja3_str_len + rc < JA3_STR_LEN) ja3_str_len += rc; else break; } rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, ","); - if(rc > 0) ja3_str_len += rc; + if(rc > 0 && ja3_str_len + rc < JA3_STR_LEN) ja3_str_len += rc; /* ********** */ for(i=0; i<ja3.num_tls_extension; i++) { rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, "%s%u", (i > 0) ? "-" : "", ja3.tls_extension[i]); - if(rc > 0) ja3_str_len += rc; else break; + if(rc > 0 && ja3_str_len + rc < JA3_STR_LEN) ja3_str_len += rc; else break; } rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, ","); - if(rc > 0) ja3_str_len += rc; + if(rc > 0 && ja3_str_len + rc < JA3_STR_LEN) ja3_str_len += rc; /* ********** */ for(i=0; i<ja3.num_elliptic_curve; i++) { rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, "%s%u", (i > 0) ? "-" : "", ja3.elliptic_curve[i]); - if(rc > 0) ja3_str_len += rc; else break; + if(rc > 0 && ja3_str_len + rc < JA3_STR_LEN) ja3_str_len += rc; else break; } rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, ","); - if(rc > 0) ja3_str_len += rc; + if(rc > 0 && ja3_str_len + rc < JA3_STR_LEN) ja3_str_len += rc; for(i=0; i<ja3.num_elliptic_curve_point_format; i++) { rc = snprintf(&ja3_str[ja3_str_len], sizeof(ja3_str)-ja3_str_len, "%s%u", (i > 0) ? "-" : "", ja3.elliptic_curve_point_format[i]); - if(rc > 0) ja3_str_len += rc; else break; + if(rc > 0 && ja3_str_len + rc < JA3_STR_LEN) ja3_str_len += rc; else break; } #ifdef DEBUG_TLS |