Fix heap-buffer-overflow in IPv4Layer::computeCalculateFields with invalid IHL (#1866) (#2179)

Author: alacrity-aya

Packet++/src/IPv4Layer.cpp

@@ -11,9 +11,10 @@
 #include "IPSecLayer.h"
 #include "VrrpLayer.h"
 #include "PacketUtils.h"
-#include <sstream>
 #include "Logger.h"
 #include "EndianPortable.h"
+#include <sstream>
+#include <algorithm>
 
 namespace pcpp
 {
@@ -188,9 +189,9 @@ namespace pcpp
 			// value of totalLen and look at the data captured on the wire
 			if ((totalLen < m_DataLen) && (totalLen != 0))
 			{
-				auto headerLen = getHeaderLen();
+				auto headerLen = (std::min)(getHeaderLen(), m_DataLen);
 				// Make sure totalLen is larger than header len, otherwise it's a malformed packet
-				m_DataLen = totalLen > headerLen ? totalLen : headerLen;
+				m_DataLen = (std::max)(totalLen, headerLen);
 			}
 		}
 	}
@@ -370,7 +371,7 @@ namespace pcpp
 
 	void IPv4Layer::computeCalculateFields()
 	{
-		iphdr* ipHdr = getIPv4Header();
+		auto* ipHdr = getIPv4Header();
 		ipHdr->ipVersion = (4 & 0x0f);
 		ipHdr->totalLength = htobe16(m_DataLen);
 		ipHdr->headerChecksum = 0;
@@ -406,7 +407,8 @@ namespace pcpp
 			}
 		}
 
-		ScalarBuffer<uint16_t> scalar = { (uint16_t*)ipHdr, (size_t)(ipHdr->internetHeaderLength * 4) };
+		auto headerLen = (std::min)(static_cast<size_t>(ipHdr->internetHeaderLength * 4), m_DataLen);
+		ScalarBuffer<uint16_t> scalar = { reinterpret_cast<uint16_t*>(ipHdr), headerLen };
 		ipHdr->headerChecksum = htobe16(computeChecksum(&scalar, 1));
 	}
 

Tests/Packet++Test/TestDefinition.h

@@ -24,6 +24,7 @@ PTF_TEST_CASE(IPv4FragmentationTest);
 PTF_TEST_CASE(IPv4OptionsParsingTest);
 PTF_TEST_CASE(IPv4OptionsEditTest);
 PTF_TEST_CASE(IPv4UdpChecksum);
+PTF_TEST_CASE(IPv4ComputeFieldsInvalidIhl);
 
 // Implemented in IPv6Tests.cpp
 PTF_TEST_CASE(IPv6UdpPacketParseAndCreate);

Tests/Packet++Test/Tests/IPv4Tests.cpp

@@ -528,3 +528,30 @@ PTF_TEST_CASE(IPv4UdpChecksum)
 		PTF_ASSERT_EQUAL(udpLayer->getUdpHeader()->headerChecksum, packetChecksum, hex);
 	}
 }  // Ipv4UdpChecksum
+
+PTF_TEST_CASE(IPv4ComputeFieldsInvalidIhl)
+{
+	uint8_t data[60]{};
+
+	data[12] = 0x08;
+	data[13] = 0x00;
+
+	constexpr size_t ipOffset = sizeof(pcpp::ether_header);
+	data[ipOffset] = 0x4d;  // IPv4, IHL = 13 => 52 bytes.
+	data[ipOffset + 2] = 0x00;
+	data[ipOffset + 3] = 0x1c;  // totalLength = 28.
+
+	timeval time{};
+	pcpp::RawPacket rawPacket(data, sizeof(data), time, false, pcpp::LINKTYPE_ETHERNET);
+	pcpp::Packet packet(&rawPacket);
+
+	auto ipv4Layer = packet.getLayerOfType<pcpp::IPv4Layer>();
+	PTF_ASSERT_NOT_NULL(ipv4Layer);
+	PTF_ASSERT_EQUAL(ipv4Layer->getHeaderLen(), 52);
+	PTF_ASSERT_EQUAL(ipv4Layer->getDataLen(), 46);
+	PTF_ASSERT_NULL(ipv4Layer->getNextLayer());
+
+	packet.computeCalculateFields();
+
+	PTF_ASSERT_EQUAL(ipv4Layer->getDataLen(), 46);
+}  // IPv4ComputeFieldsInvalidIhl

Tests/Packet++Test/main.cpp

@@ -137,6 +137,7 @@ int main(int argc, char* argv[])
 	PTF_RUN_TEST(IPv4OptionsParsingTest, "ipv4");
 	PTF_RUN_TEST(IPv4OptionsEditTest, "ipv4");
 	PTF_RUN_TEST(IPv4UdpChecksum, "ipv4");
+	PTF_RUN_TEST(IPv4ComputeFieldsInvalidIhl, "ipv4");
 
 	PTF_RUN_TEST(IPv6UdpPacketParseAndCreate, "ipv6");
 	PTF_RUN_TEST(IPv6FragmentationTest, "ipv6");