Wireshark · Wireshark-commits: [Wireshark-commits] master 6e88943: BGP: Validate length of Path Attribute records.

[Wireshark code review <code-review-do-not-reply@xxxxxxxxxxxxx>]

URL: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=6e88943d0eabc8c8bc11334ba4213ec64129575c
Submitter: Anders Broman (a.broman58@xxxxxxxxx)
Changed: branch: master
Repository: wireshark

Commits:

6e88943 by Darius Davis (darius@xxxxxxxxxx):

    BGP: Validate length of Path Attribute records.
    
    Bug 13741 showed a case where the BGP dissector's failure to validate the
    length of the Path Attribute record allowed a pathological BGP UPDATE packet to
    generate more than one million items in the protocol tree by repeatedly
    dissecting certain segments of the packet.
    
    It's easy enough to detect when the Path Attribute length cannot be valid, so
    let's do so.  When the condition arises, let's raise an Expert Info error in
    the same style and format as used elsewhere in the same routine, and abandon
    dissection of the Path Attributes list.
    
    With this check in place, an incorrect length computation is revealed at a
    callsite.  This would only have prevented a small (less than 5 bytes) Path
    Attribute from being dissected if it was at the very end of the Path Attributes
    list, but the bounds checking added in this change makes this problem much more
    apparent, so we fix the length computation while we're here.
    
    Testing Done: Built wireshark on Linux amd64.  Using bgp.pcap from the Sample
       Captures page on the wiki, verified that the dissection of the UPDATE
       packets were unaltered by this fix.  Using the capture attached to bug 13741
       (clusterfuzz-testcase-minimized-6689222578667520.pcap), verified that the
       packet no longer triggers the "too many items" exception, instead we see
       an Expert Info for each oversized Path Attribute length, and eventually an
       exception for "length of contained item exceeds length of containing item".
       30,000 iterations of fuzz test with bgp.pcap as input, and many iterations
       of randpkt-test too.  Crafted a packet with a 3-byte ATOMIC_AGGREGATE Path
       Attribute at the end of the Path Attributes list; Before this change, an
       exception is raised during dissection, but after this change it is dissected
       correctly.
    
    Bug: 13741
    Change-Id: I80f506b114a61e5b060d93b59bed6b94fb188b3e
    Reviewed-on: https://code.wireshark.org/review/27466
    Reviewed-by: Peter Wu <peter@xxxxxxxxxxxxx>
    Petri-Dish: Peter Wu <peter@xxxxxxxxxxxxx>
    Tested-by: Petri Dish Buildbot
    Reviewed-by: Anders Broman <a.broman58@xxxxxxxxx>
    

Actions performed:

    from  d80dbe5   Display configured checksum Expert summary string
    adds  6e88943   BGP: Validate length of Path Attribute records.


Summary of changes:
 epan/dissectors/packet-bgp.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)