From 65d462ba7c1de98bc1aaa2bef4880bcca8344e5f Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Mon, 20 Jul 2026 17:07:39 +0200 Subject: [PATCH] BUG/MEDIUM: net-helper: Adjust sample size capacity after pointer shift eth.data, eth.src and ip.data converters are concerned. On success, the area pointer of the sample buffer is moved forward without updating the buffer size accordingly. If these converters are followed by another one relying on the buffer size to do some operations on the buffer area, this could lead to a buffer overflow. Thanks to Charles Vosburgh for reporting this and providing the fix. This patch must be backported to 3.4. --- src/net_helper.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/net_helper.c b/src/net_helper.c index 85990a289..4cfa457cb 100644 --- a/src/net_helper.c +++ b/src/net_helper.c @@ -25,6 +25,8 @@ static int sample_conv_eth_data(const struct arg *arg_p, struct sample *smp, voi for (idx = 12; idx + 2 < smp->data.u.str.data; idx += 4) { if (read_n16(smp->data.u.str.area + idx) != 0x8100) { + if (smp->data.u.str.size) + smp->data.u.str.size -= idx + 2; smp->data.u.str.area += idx + 2; smp->data.u.str.data -= idx + 2; return 1; @@ -90,6 +92,8 @@ static int sample_conv_eth_src(const struct arg *arg_p, struct sample *smp, void if (smp->data.u.str.data < 12) return 0; + if (smp->data.u.str.size) + smp->data.u.str.size -= 6; smp->data.u.str.area += 6; // src is at address 6 smp->data.u.str.data = 6; // output length is 6 return 1; @@ -178,6 +182,8 @@ static int sample_conv_ip_data(const struct arg *arg_p, struct sample *smp, void return 0; /* advance buffer by */ + if (smp->data.u.str.size) + smp->data.u.str.size -= len; smp->data.u.str.area += len; smp->data.u.str.data -= len; return 1; -- 2.47.3