From d3110859064b15408dbca1294dc7e31c2208504d Mon Sep 17 00:00:00 2001 From: Gabriel Ganne Date: Mon, 3 Aug 2020 08:26:38 +0200 Subject: [PATCH] fix heap-buffer-overflow when DLT_JUNIPER_ETHER The test logic on datalen was inverted. Processing truncated packats should now raise a warning like the following: Warning: was captured using a snaplen of 4 bytes. This may mean you have truncated packets. Fixes #616 #617 CVE: CVE-2020-24265 CVE: CVE-2020-24266 Upstream-Status: Backport [https://github.com/appneta/tcpreplay/commit/d3110859064b15408dbca1294dc7e31c2208504d] Signed-off-by: Gabriel Ganne Signed-off-by: Akash Hadke Signed-off-by: Akash Hadke --- src/common/get.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/common/get.c b/src/common/get.c index f9ee92d3..0517bf0a 100644 --- a/src/common/get.c +++ b/src/common/get.c @@ -178,7 +178,7 @@ get_l2len(const u_char *pktdata, const int datalen, const int datalink) break; case DLT_JUNIPER_ETHER: - if (datalen >= 5) { + if (datalen < 5) { l2_len = -1; break; }