lldp: check that lldp neighbor raw data size is in expected range

This fixes an insecure use of tainted data as argument to functions that
allocate memory and read from files, which could be tricked into getting
networkctl to allocate a large amount of memory and fill it with file
data.

This was uncovered by Coverity. Fixes CID 1393254.

diff --git a/src/network/networkctl.c b/src/network/networkctl.c
index 29899a9ba74b9a026fef093e7d3f21454dc033c6..ccfab40b4df995bfa9f8d79ce6896cdb377448cc 100644 (file)
--- a/src/network/networkctl.c
+++ b/src/network/networkctl.c
@@ -636,6 +636,10 @@ static int next_lldp_neighbor(FILE *f, sd_lldp_neighbor **ret) {
         if (l != sizeof(u))
                 return -EBADMSG;
 
+        /* each LLDP packet is at most MTU size, but let's allow up to 4KiB just in case */
+        if (le64toh(u) >= 4096)
+                return -EBADMSG;
+
         raw = new(uint8_t, le64toh(u));
         if (!raw)
                 return -ENOMEM;