diff options
author | imp <imp@FreeBSD.org> | 1998-04-01 00:32:18 +0000 |
---|---|---|
committer | imp <imp@FreeBSD.org> | 1998-04-01 00:32:18 +0000 |
commit | 64af92eaa57c6aeb1fed4ca6a1316114b6e07ffd (patch) | |
tree | 89d363998a6c040b02fc998b3074a680a680d569 | |
parent | 0b984010ad50c53381a5c56153acb2c2a6d637e2 (diff) | |
download | FreeBSD-src-64af92eaa57c6aeb1fed4ca6a1316114b6e07ffd.zip FreeBSD-src-64af92eaa57c6aeb1fed4ca6a1316114b6e07ffd.tar.gz |
A fairly rare possible buffer overflow:
Theo fixed this and tqbf reported it
Obtained from: OpenBSD
-rw-r--r-- | sbin/ping/ping.8 | 5 | ||||
-rw-r--r-- | sbin/ping/ping.c | 17 |
2 files changed, 17 insertions, 5 deletions
diff --git a/sbin/ping/ping.8 b/sbin/ping/ping.8 index befbef0..76bb090 100644 --- a/sbin/ping/ping.8 +++ b/sbin/ping/ping.8 @@ -30,7 +30,7 @@ .\" SUCH DAMAGE. .\" .\" @(#)ping.8 8.2 (Berkeley) 12/11/93 -.\" $Id: ping.8,v 1.12 1997/07/18 17:52:03 wollman Exp $ +.\" $Id: ping.8,v 1.13 1998/03/19 07:45:57 charnier Exp $ .\" .Dd March 1, 1997 .Dt PING 8 @@ -173,6 +173,9 @@ the .Xr traceroute 8 command is usually better at determining the route packets take to a particular destination. +If more routes come back than should, such as due to an illegal spoofed +packet, ping will print the route list and then truncate it at the correct +spot. Many hosts ignore or discard the .Tn RECORD_ROUTE option. diff --git a/sbin/ping/ping.c b/sbin/ping/ping.c index f98123d..c1f558e 100644 --- a/sbin/ping/ping.c +++ b/sbin/ping/ping.c @@ -45,7 +45,7 @@ static const char copyright[] = static char sccsid[] = "@(#)ping.c 8.1 (Berkeley) 6/5/93"; */ static const char rcsid[] = - "$Id: ping.c,v 1.28 1997/08/11 04:33:07 fenner Exp $"; + "$Id: ping.c,v 1.29 1997/12/24 00:59:02 imp Exp $"; #endif /* not lint */ /* @@ -261,7 +261,6 @@ main(argc, argv) errno = EPERM; err(EX_NOPERM, "-l flag"); } - options |= F_FLOOD; preload = ultmp; break; case 'L': @@ -787,9 +786,14 @@ pr_pack(buf, cc, from) cp += i; break; } - old_rrlen = i; - bcopy((char *)cp, old_rr, i); + if (i < MAXIPOPTLEN) { + old_rrlen = i; + bcopy((char *)cp, old_rr, i); + } else + old_rrlen = 0; + (void)printf("\nRR: "); + j = 0; for (;;) { l = *++cp; l = (l<<8) + *++cp; @@ -804,8 +808,13 @@ pr_pack(buf, cc, from) } hlen -= 4; i -= 4; + j += 4; if (i <= 0) break; + if (j >= MAX_IPOPTLEN) { + (void) printf("\t(truncated route)"); + break; + } (void)putchar('\n'); } break; |