[Bug 3610] process_control() should bail earlier on short packets. stenn@

bk: 5d6b094axCclawopUzI7_YAnJghpFg

diff --git a/ChangeLog b/ChangeLog
index 64f404a51e0b9f1d65a26468a4e7cc536391491e..1491eaad293ff90f7c7e210d3c998056c6fbdc94 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 ---
 
+* [Bug 3610] process_control() should bail earlier on short packets. stenn@
+  - Reported by Philippe Antoine
 * [Bug 3608] libparse fails to compile on S11.4SRU13 and later <perlinger@ntp.org>
   - removed ffs() and fls() prototypes as per Brian Utterback
 * [Bug 3604] Wrong param byte order passing into record_raw_stats() in

diff --git a/ntpd/ntp_control.c b/ntpd/ntp_control.c
index 8245054741e1660bb4a6c42bf9dc71dd2b059cf9..cb476320bde8c1d24617853902ea995b4273925a 100644 (file)
--- a/ntpd/ntp_control.c
+++ b/ntpd/ntp_control.c
@@ -1189,15 +1189,21 @@ process_control(
        pkt = (struct ntp_control *)&rbufp->recv_pkt;
 
        /*
-        * If the length is less than required for the header, or
-        * it is a response or a fragment, ignore this.
+        * If the length is less than required for the header,
+        * ignore it.
         */
-       if (rbufp->recv_length < (int)CTL_HEADER_LEN
-           || (CTL_RESPONSE | CTL_MORE | CTL_ERROR) & pkt->r_m_e_op
+       if (rbufp->recv_length < (int)CTL_HEADER_LEN) {
+               DPRINTF(1, ("Short control packet\n"));
+               numctltooshort++;
+               return;
+       }
+
+       /*
+        * If this packet is a response or a fragment, ignore it.
+        */
+       if (   (CTL_RESPONSE | CTL_MORE | CTL_ERROR) & pkt->r_m_e_op
            || pkt->offset != 0) {
                DPRINTF(1, ("invalid format in control packet\n"));
-               if (rbufp->recv_length < (int)CTL_HEADER_LEN)
-                       numctltooshort++;
                if (CTL_RESPONSE & pkt->r_m_e_op)
                        numctlinputresp++;
                if (CTL_MORE & pkt->r_m_e_op)
@@ -1208,6 +1214,7 @@ process_control(
                        numctlbadoffset++;
                return;
        }
+
        res_version = PKT_VERSION(pkt->li_vn_mode);
        if (res_version > NTP_VERSION || res_version < NTP_OLDVERSION) {
                DPRINTF(1, ("unknown version %d in control packet\n",