BUG/MEDIUM: net-helper: Adjust sample size capacity after pointer shift

eth.data, eth.src and ip.data converters are concerned. On success, the area
pointer of the sample buffer is moved forward without updating the buffer
size accordingly. If these converters are followed by another one relying on
the buffer size to do some operations on the buffer area, this could lead to
a buffer overflow.

Thanks to Charles Vosburgh <theminershive@gmail.com> for reporting this and
providing the fix.

This patch must be backported to 3.4.

diff --git a/src/net_helper.c b/src/net_helper.c
index 85990a289afe12b3c0adfc3ab90d3c98dc2cba1e..4cfa457cbc1f98179c1028c1886e0d6f90b72b00 100644 (file)
--- a/src/net_helper.c
+++ b/src/net_helper.c
@@ -25,6 +25,8 @@ static int sample_conv_eth_data(const struct arg *arg_p, struct sample *smp, voi
 
        for (idx = 12; idx + 2 < smp->data.u.str.data; idx += 4) {
                if (read_n16(smp->data.u.str.area + idx) != 0x8100) {
+                       if (smp->data.u.str.size)
+                               smp->data.u.str.size -= idx + 2;
                        smp->data.u.str.area += idx + 2;
                        smp->data.u.str.data -= idx + 2;
                        return 1;
@@ -90,6 +92,8 @@ static int sample_conv_eth_src(const struct arg *arg_p, struct sample *smp, void
        if (smp->data.u.str.data < 12)
                return 0;
 
+       if (smp->data.u.str.size)
+               smp->data.u.str.size -= 6;
        smp->data.u.str.area += 6; // src is at address 6
        smp->data.u.str.data  = 6; // output length is 6
        return 1;
@@ -178,6 +182,8 @@ static int sample_conv_ip_data(const struct arg *arg_p, struct sample *smp, void
                return 0;
 
        /* advance buffer by <len> */
+       if (smp->data.u.str.size)
+               smp->data.u.str.size -= len;
        smp->data.u.str.area += len;
        smp->data.u.str.data -= len;
        return 1;