Skip to content

Raise dpkt error instead of IndexError on truncated SSL2 and BGP EVPN records #683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
eeshsaxena wants to merge 1 commit into from
Closed

Raise dpkt error instead of IndexError on truncated SSL2 and BGP EVPN records #683

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions dpkt/bgp.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -758,6 +758,8 @@ def unpack(self, buf):
buf = buf[4:]

if self.type == 0x2:
if not buf:
raise dpkt.NeedData('truncated EVPN route: missing MAC address length')
self.mac_address_length = compat_ord(buf[0])
if self.mac_address_length == 48:
self.mac_address = buf[1:7]
Expand All @@ -767,6 +769,8 @@ def unpack(self, buf):
buf = buf[1:]

if self.type != 0x1:
if not buf:
raise dpkt.NeedData('truncated EVPN route: missing IP address length')
self.ip_address_length = compat_ord(buf[0])
if self.ip_address_length == 128:
self.ip_address = buf[1:17]
Expand Down Expand Up @@ -1583,3 +1587,13 @@ def test_reservedcommunities():

assert len(communities) == 4
assert bytes(communities) == buf


def test_route_evpn_truncated():
# A truncated EVPN route must raise NeedData rather than IndexError when
# reading the MAC/IP address length byte from an exhausted buffer.
import pytest
# type != 1, buffer exhausted before the IP address length byte
pytest.raises(dpkt.NeedData, RouteEVPN, b'\xff\xff\xff\xff')
# type == 2, buffer exhausted before the MAC address length byte
pytest.raises(dpkt.NeedData, RouteEVPN, b'\x02\x12' + b'\x00' * 18)
14 changes: 14 additions & 0 deletions dpkt/ssl.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,11 @@ def unpack(self, buf):
# protocol). In either case, the length code describes how much
# data is in the record.
n = self.len = self.len & 0x3FFF
if not self.data:
# 3-byte header form promises a padding-length byte after the
# 2-byte length; a truncated record has none. Signal NeedData
# instead of indexing an empty buffer (IndexError).
raise dpkt.NeedData('truncated SSL2 record: missing padding length')
padlen = compat_ord(self.data[0])

self.msg = self.data[1:1 + n]
Expand Down Expand Up @@ -953,6 +958,15 @@ def test_ssl2():
assert ssl2.data == b'\x06\x07'


def test_ssl2_truncated_padding_length():
# 3-byte header form (MSB of len clear) promises a padding-length byte;
# a record that stops after the 2-byte length must raise NeedData, not
# IndexError.
import pytest
from binascii import unhexlify
pytest.raises(dpkt.NeedData, SSL2, unhexlify('0001'))


def test_clienthello_invalidcipher():
# NOTE: this test relies on ciphersuite 0x001c not being in ssl_ciphersuites.py CIPHERSUITES.
# IANA has reserved this value to avoid conflict with SSLv3, but if it gets reassigned,
Expand Down