From: Filipe Brandenburger <filbranden@google.com>
Date: Thu, 7 Jun 2018 20:46:32 +0000 (-0700)
Subject: lldp: check that lldp neighbor raw data size is in expected range
X-Git-Tag: v239~116
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d23c3e4c28f21b2f6543747d62e289ed4085458f;p=thirdparty%2Fsystemd.git

lldp: check that lldp neighbor raw data size is in expected range

This fixes an insecure use of tainted data as argument to functions that
allocate memory and read from files, which could be tricked into getting
networkctl to allocate a large amount of memory and fill it with file
data.

This was uncovered by Coverity. Fixes CID 1393254.
---

diff --git a/src/network/networkctl.c b/src/network/networkctl.c
index 29899a9ba74..ccfab40b4df 100644
--- a/src/network/networkctl.c
+++ b/src/network/networkctl.c
@@ -636,6 +636,10 @@ static int next_lldp_neighbor(FILE *f, sd_lldp_neighbor **ret) {
         if (l != sizeof(u))
                 return -EBADMSG;
 
+        /* each LLDP packet is at most MTU size, but let's allow up to 4KiB just in case */
+        if (le64toh(u) >= 4096)
+                return -EBADMSG;
+
         raw = new(uint8_t, le64toh(u));
         if (!raw)
                 return -ENOMEM;