From df18692af981012e5052216845d3eaad59d3034f Mon Sep 17 00:00:00 2001 From: orignal Date: Fri, 1 Dec 2017 12:57:05 -0500 Subject: [PATCH] check I2NP messsage buffer size --- libi2pd/Destination.cpp | 4 +-- libi2pd/Garlic.cpp | 56 ++++++++++++++++++++++++++++++++------- libi2pd/I2NPProtocol.cpp | 28 +++++++++++++++++--- libi2pd/I2NPProtocol.h | 2 +- libi2pd/RouterContext.cpp | 2 +- 5 files changed, 76 insertions(+), 16 deletions(-) diff --git a/libi2pd/Destination.cpp b/libi2pd/Destination.cpp index 4b6e8bc8..0c3a1512 100644 --- a/libi2pd/Destination.cpp +++ b/libi2pd/Destination.cpp @@ -283,7 +283,7 @@ namespace client break; case eI2NPDeliveryStatus: // we assume tunnel tests non-encrypted - HandleDeliveryStatusMessage (CreateI2NPMessage (buf, GetI2NPMessageLength (buf), from)); + HandleDeliveryStatusMessage (CreateI2NPMessage (buf, GetI2NPMessageLength (buf, len), from)); break; case eI2NPDatabaseStore: HandleDatabaseStoreMessage (buf + I2NP_HEADER_SIZE, bufbe16toh (buf + I2NP_HEADER_SIZE_OFFSET)); @@ -292,7 +292,7 @@ namespace client HandleDatabaseSearchReplyMessage (buf + I2NP_HEADER_SIZE, bufbe16toh (buf + I2NP_HEADER_SIZE_OFFSET)); break; default: - i2p::HandleI2NPMessage (CreateI2NPMessage (buf, GetI2NPMessageLength (buf), from)); + i2p::HandleI2NPMessage (CreateI2NPMessage (buf, GetI2NPMessageLength (buf, len), from)); } } diff --git a/libi2pd/Garlic.cpp b/libi2pd/Garlic.cpp index e84312f8..3212da01 100644 --- a/libi2pd/Garlic.cpp +++ b/libi2pd/Garlic.cpp @@ -512,12 +512,17 @@ namespace garlic void GarlicDestination::HandleGarlicPayload (uint8_t * buf, size_t len, std::shared_ptr from) { - const uint8_t * buf1 = buf; + if (len < 1) + { + LogPrint (eLogError, "Garlic: payload is too short"); + return; + } int numCloves = buf[0]; LogPrint (eLogDebug, "Garlic: ", numCloves," cloves"); - buf++; + buf++; len--; for (int i = 0; i < numCloves; i++) { + const uint8_t * buf1 = buf; // delivery instructions uint8_t flag = buf[0]; buf++; // flag @@ -527,17 +532,29 @@ namespace garlic LogPrint (eLogWarning, "Garlic: clove encrypted"); buf += 32; } + ptrdiff_t offset = buf - buf1; GarlicDeliveryType deliveryType = (GarlicDeliveryType)((flag >> 5) & 0x03); switch (deliveryType) { case eGarlicDeliveryTypeLocal: LogPrint (eLogDebug, "Garlic: type local"); - HandleI2NPMessage (buf, len, from); + if (offset > (int)len) + { + LogPrint (eLogError, "Garlic: message is too short"); + break; + } + HandleI2NPMessage (buf, len - offset, from); break; case eGarlicDeliveryTypeDestination: LogPrint (eLogDebug, "Garlic: type destination"); buf += 32; // destination. check it later or for multiple destinations - HandleI2NPMessage (buf, len, from); + offset = buf1 - buf; + if (offset > (int)len) + { + LogPrint (eLogError, "Garlic: message is too short"); + break; + } + HandleI2NPMessage (buf, len - offset, from); break; case eGarlicDeliveryTypeTunnel: { @@ -545,9 +562,15 @@ namespace garlic // gwHash and gwTunnel sequence is reverted uint8_t * gwHash = buf; buf += 32; + offset = buf1 - buf; + if (offset + 4 > (int)len) + { + LogPrint (eLogError, "Garlic: message is too short"); + break; + } uint32_t gwTunnel = bufbe32toh (buf); - buf += 4; - auto msg = CreateI2NPMessage (buf, GetI2NPMessageLength (buf), from); + buf += 4; offset += 4; + auto msg = CreateI2NPMessage (buf, GetI2NPMessageLength (buf, len - offset), from); if (from) // received through an inbound tunnel { std::shared_ptr tunnel; @@ -568,9 +591,17 @@ namespace garlic { uint8_t * ident = buf; buf += 32; + offset = buf1 - buf; if (!from) // received directly + { + if (offset > (int)len) + { + LogPrint (eLogError, "Garlic: message is too short"); + break; + } i2p::transport::transports.SendMessage (ident, - CreateI2NPMessage (buf, GetI2NPMessageLength (buf))); + CreateI2NPMessage (buf, GetI2NPMessageLength (buf, len - offset))); + } else LogPrint (eLogWarning, "Garlic: type router for inbound tunnels not supported"); break; @@ -578,15 +609,22 @@ namespace garlic default: LogPrint (eLogWarning, "Garlic: unknown delivery type ", (int)deliveryType); } - buf += GetI2NPMessageLength (buf); // I2NP + if (offset > (int)len) + { + LogPrint (eLogError, "Garlic: message is too short"); + break; + } + buf += GetI2NPMessageLength (buf, len - offset); // I2NP buf += 4; // CloveID buf += 8; // Date buf += 3; // Certificate - if (buf - buf1 > (int)len) + offset = buf1 - buf; + if (offset > (int)len) { LogPrint (eLogError, "Garlic: clove is too long"); break; } + len -= offset; } } diff --git a/libi2pd/I2NPProtocol.cpp b/libi2pd/I2NPProtocol.cpp index 7fde4893..5719a1b0 100644 --- a/libi2pd/I2NPProtocol.cpp +++ b/libi2pd/I2NPProtocol.cpp @@ -546,18 +546,40 @@ namespace i2p return msg; } - size_t GetI2NPMessageLength (const uint8_t * msg) + size_t GetI2NPMessageLength (const uint8_t * msg, size_t len) { - return bufbe16toh (msg + I2NP_HEADER_SIZE_OFFSET) + I2NP_HEADER_SIZE; + if (len < I2NP_HEADER_SIZE_OFFSET + 2) + { + LogPrint (eLogError, "I2NP: message length ", len, " is smaller than header"); + return len; + } + auto l = bufbe16toh (msg + I2NP_HEADER_SIZE_OFFSET) + I2NP_HEADER_SIZE; + if (l > len) + { + LogPrint (eLogError, "I2NP: message length ", l, " exceeds buffer length ", len); + l = len; + } + return l; } void HandleI2NPMessage (uint8_t * msg, size_t len) { + if (len < I2NP_HEADER_SIZE) + { + LogPrint (eLogError, "I2NP: message length ", len, " is smaller than header"); + return; + } uint8_t typeID = msg[I2NP_HEADER_TYPEID_OFFSET]; uint32_t msgID = bufbe32toh (msg + I2NP_HEADER_MSGID_OFFSET); LogPrint (eLogDebug, "I2NP: msg received len=", len,", type=", (int)typeID, ", msgID=", (unsigned int)msgID); uint8_t * buf = msg + I2NP_HEADER_SIZE; - int size = bufbe16toh (msg + I2NP_HEADER_SIZE_OFFSET); + auto size = bufbe16toh (msg + I2NP_HEADER_SIZE_OFFSET); + len -= I2NP_HEADER_SIZE; + if (size > len) + { + LogPrint (eLogError, "I2NP: payload size ", size, " exceeds buffer length ", len); + size = len; + } switch (typeID) { case eI2NPVariableTunnelBuild: diff --git a/libi2pd/I2NPProtocol.h b/libi2pd/I2NPProtocol.h index 2f8aac7b..3f36b0a8 100644 --- a/libi2pd/I2NPProtocol.h +++ b/libi2pd/I2NPProtocol.h @@ -243,7 +243,7 @@ namespace tunnel const uint8_t * buf, size_t len, uint32_t replyMsgID = 0); std::shared_ptr CreateTunnelGatewayMsg (uint32_t tunnelID, std::shared_ptr msg); - size_t GetI2NPMessageLength (const uint8_t * msg); + size_t GetI2NPMessageLength (const uint8_t * msg, size_t len); void HandleI2NPMessage (uint8_t * msg, size_t len); void HandleI2NPMessage (std::shared_ptr msg); diff --git a/libi2pd/RouterContext.cpp b/libi2pd/RouterContext.cpp index a49f1718..80a03abf 100644 --- a/libi2pd/RouterContext.cpp +++ b/libi2pd/RouterContext.cpp @@ -454,7 +454,7 @@ namespace i2p void RouterContext::HandleI2NPMessage (const uint8_t * buf, size_t len, std::shared_ptr from) { - i2p::HandleI2NPMessage (CreateI2NPMessage (buf, GetI2NPMessageLength (buf), from)); + i2p::HandleI2NPMessage (CreateI2NPMessage (buf, GetI2NPMessageLength (buf, len), from)); } void RouterContext::ProcessGarlicMessage (std::shared_ptr msg)