Fix: OOB read / potential heap overflow nasl_packet_forgery*

Author: jjnicola

nasl/nasl_packet_forgery.c

@@ -370,9 +370,9 @@ insert_ip_options (lex_ctxt *lexic)
   int pad_len;
   char zero = '0';
   int i;
-  int hl;
+  size_t hl;
 
-  if (ip == NULL)
+  if (ip == NULL || value == NULL)
     {
       nasl_perror (lexic, "Usage : insert_ip_options(ip:<ip>, code:<code>, "
                           "length:<len>, value:<value>\n");
@@ -384,7 +384,11 @@ insert_ip_options (lex_ctxt *lexic)
     pad_len = 0;
 
   hl = ip->ip_hl * 4 < UNFIX (ip->ip_len) ? ip->ip_hl * 4 : UNFIX (ip->ip_len);
+  if (hl > size)
+    return NULL; // malformed.
+
   new_packet = g_malloc0 (size + 4 + value_size + pad_len);
+
   bcopy (ip, new_packet, hl);
 
   uc_code = (u_char) code;
@@ -898,6 +902,13 @@ get_tcp_option (lex_ctxt *lexic)
   ip = (struct ip *) packet;
 
   ipsz = get_var_size_by_name (lexic, "tcp");
+  if (ipsz < (int) sizeof (struct ip))
+    return NULL;
+
+  // check that ip + tcp is bigger that the original packet
+  if (ip->ip_hl * 4 + 20 > ipsz)
+    return NULL;
+
   // ip header length is given in 32 bits words = 4 bytes.
   if (ip->ip_hl * 4 > ipsz)
     return NULL; /* Invalid packet */

nasl/nasl_packet_forgery_v6.c

@@ -407,9 +407,9 @@ insert_ip_v6_options (lex_ctxt *lexic)
   int pad_len;
   char zero = '0';
   int i;
-  int pl;
+  size_t pl;
 
-  if (ip6 == NULL)
+  if (ip6 == NULL && value == NULL)
     {
       nasl_perror (lexic,
                    "Usage : %s(ip6:<ip6>, code:<code>, "
@@ -423,6 +423,10 @@ insert_ip_v6_options (lex_ctxt *lexic)
     pad_len = 0;
 
   pl = 40 < UNFIX (ip6->ip6_plen) ? 40 : UNFIX (ip6->ip6_plen);
+
+  if (pl > size)
+    return NULL; // malformed packet.
+
   new_packet = g_malloc0 (size + 4 + value_size + pad_len);
   bcopy (ip6, new_packet, pl);
 
@@ -863,6 +867,12 @@ get_tcp_v6_option (lex_ctxt *lexic)
 
   /* valid ipv6 header check */
   ipsz = get_var_size_by_name (lexic, "tcp");
+  if (ipsz < (int) sizeof (struct ip6_hdr))
+    return NULL; // mal formed.
+
+  if (40 + 20 > ipsz)
+    return NULL;
+
   if (UNFIX (ip6->ip6_plen) > ipsz)
     return NULL; /* Invalid packet */