diff options
| author | emanuele-f <black.silver@hotmail.it> | 2019-10-04 14:35:31 +0200 |
|---|---|---|
| committer | emanuele-f <black.silver@hotmail.it> | 2019-10-04 14:35:51 +0200 |
| commit | 4bdbf02c2d5eb871dca4ec620bb66fcc16a74af1 (patch) | |
| tree | 83025a19fefb32d47c9d8f365fb0eb938af27737 /src | |
| parent | f83b2a0940cf86ee07305e970b9650efbfa4eb00 (diff) | |
Fix invalid memory accesses
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/tls.c | 9 | ||||
| -rw-r--r-- | src/lib/protocols/viber.c | 2 |
2 files changed, 8 insertions, 3 deletions
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index f621c2be3..cb4f7ac05 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -786,7 +786,12 @@ int getSSCertificateFingerprint(struct ndpi_detection_module_struct *ndpi_struct #endif return(1); /* More packets please */ } - } + } + + if(packet->payload_packet_len <= flow->l4.tcp.tls_record_offset) { + /* Avoid invalid memory accesses */ + return(1); + } if(packet->payload[flow->l4.tcp.tls_record_offset] == 0x15 /* Alert */) { u_int len = ntohs(*(u_int16_t*)&packet->payload[flow->l4.tcp.tls_record_offset+3]) + 5 /* SSL header len */; @@ -833,7 +838,7 @@ int getSSCertificateFingerprint(struct ndpi_detection_module_struct *ndpi_struct return(0); /* That's all */ } else if(flow->l4.tcp.tls_seen_certificate) return(0); /* That's all */ - else { + else if(packet->payload_packet_len > flow->l4.tcp.tls_record_offset+7) { /* This is a handshake but not a certificate record */ u_int16_t len = ntohs(*(u_int16_t*)&packet->payload[flow->l4.tcp.tls_record_offset+7]); diff --git a/src/lib/protocols/viber.c b/src/lib/protocols/viber.c index 28ac864e7..04f781e7b 100644 --- a/src/lib/protocols/viber.c +++ b/src/lib/protocols/viber.c @@ -31,7 +31,7 @@ void ndpi_search_viber(struct ndpi_detection_module_struct *ndpi_struct, struct NDPI_LOG_DBG(ndpi_struct, "search for VIBER\n"); - if(packet->udp != NULL) { + if((packet->udp != NULL) && (packet->payload_packet_len > 5)) { NDPI_LOG_DBG2(ndpi_struct, "calculating dport over udp\n"); if((packet->payload[2] == 0x03 && packet->payload[3] == 0x00) |