Fix packet capture crash paths ・ 94233c2 ・ Gitprep

- Fix packet capture crash paths;
- Browse files
- Yanik Cawidrone commited on 2026-10-14
- 1 parent 644e75d
  
  commit 94233c28e1b06bfb70dca48319884a79c0b54f18

Showing 3 changed files with 81 additions and 30 deletions

+29 -20

inodelist.c

@@ -62,6 +62,7 @@ void inodelist_insert_head(inode_t inode) {
 		head->prev = link;
 	}
 
+	link->prev = NULL;
 	link->next = head;
 	head = link;
 }
@@ -82,6 +83,9 @@ void inodelist_insert_tail(inode_t inode) {
 
 inodelist_t* inodelist_remove_head() {
 	inodelist_t *tempLink = head;
+	if (tempLink == NULL) {
+		return NULL;
+	}
 
 	if(head->next == NULL){
 		last = NULL;
@@ -94,15 +98,17 @@ inodelist_t* inodelist_remove_head() {
 }
 
 inodelist_t* inodelist_remove_tail() {
-   inodelist_t *tempLink = head;
-	
-   if(head->next == NULL) {
-      head = NULL;
-   } else {
-      last->prev->next = NULL;
-   }
+	if (last == NULL) {
+		return NULL;
+	}
+	inodelist_t *tempLink = last;
 	
-   last = last->prev;
+	last = last->prev;
+	if (last == NULL) {
+		head = NULL;
+	} else {
+		last->next = NULL;
+	}
    return tempLink;
 }
 
@@ -114,19 +120,22 @@ inodelist_t* inodelist_remove_at(int index) {
 		return NULL;
 	}
 	
-	while(current->next != NULL) {
-		if(current->next == NULL) {
-			return NULL;
-		} 
+	while(current != NULL) {
 		if( cpt == index ) {
 			break;
 		}
 		cpt++;
 		current = current->next;
 	}
+	if (current == NULL) {
+		return NULL;
+	}
 
 	if(current == head) {
 		head = head->next;
+		if (head != NULL) {
+			head->prev = NULL;
+		}
 	} else {
 		current->prev->next = current->next;
 	}    
@@ -143,7 +152,7 @@ inodelist_t* inodelist_remove_at(int index) {
 int32_t inodelist_get_index_from_value(uint32_t inodeval) {
 	inodelist_t* current = head;
 	int32_t cpt = 0;
-	while(current->next != NULL) {
+	while(current != NULL) {
 		if( current->data.inode == inodeval ) {
 			return cpt;
 		}
@@ -155,7 +164,7 @@ int32_t inodelist_get_index_from_value(uint32_t inodeval) {
 
 inodelist_t *inodelist_get_inode_from_value(uint32_t inodeval) {
 	inodelist_t* current = head;
-	while(current->next != NULL) {
+	while(current != NULL) {
 		if( current->data.inode == inodeval ) {
 			return current;
 		}
@@ -174,7 +183,7 @@ void inodelist_insert_if_not(uint32_t inodeval) {
 		return;
 	}
 	inodelist_t* current = head;
-	while(current->next != NULL) {
+	while(current != NULL) {
 		if( current->data.inode == inodeval ) {
 			fprintf(stderr, "inode:%d already there\n", inodeval );
 			return;
@@ -201,7 +210,7 @@ void inodelist_insert_if_not_with_hashkey(uint32_t inodeval, const char *hashkey
 		return;
 	}
 	inodelist_t* current = head;
-	while(current->next != NULL) {
+	while(current != NULL) {
 		if( current->data.inode == inodeval ) {
 			//~ fprintf(stderr, "inode:%d already there\n", inodeval );
 			return;
@@ -222,10 +231,10 @@ void inodelist_insert_if_not_with_hashkey(uint32_t inodeval, const char *hashkey
 
 inodelist_t* inodelist_find_hashkey(const char *hashkey) {
 	inodelist_t* current = head;
-	while(current->next != NULL) {
-		if( 0 == memcmp( current->data.hashkey, hashkey, strlen(hashkey) ) ) {
+	while(current != NULL) {
+	if( 0 == strcmp(current->data.hashkey, hashkey) ) {
 			return current;
-		} else if ( 0 == memcmp( current->data.hashkey2, hashkey, strlen(hashkey) ) ) {
+		} else if ( 0 == strcmp(current->data.hashkey2, hashkey) ) {
 			return current;
 		}
 		current = current->next;
@@ -236,7 +245,7 @@ inodelist_t* inodelist_find_hashkey(const char *hashkey) {
 int32_t inodelist_get_index_from_pid(pid_t pid) {
 	inodelist_t* current = head;
 	int32_t cpt = 0;
-	while(current->next != NULL) {
+	while(current != NULL) {
 		if( current->data.pid == pid ) {
 			return cpt;
 		}

+40 -10

main.c

View

@@ -52,6 +52,11 @@ static char errbuff[PCAP_ERRBUF_SIZE]="";
 void pcap_loop_cb(u_char *useless,const struct pcap_pkthdr* header,const u_char*
         packet)
 {
+	(void)useless;
+	if (header == NULL || packet == NULL) {
+		return;
+	}
+
 	//Inode <-> Process Update
 	cnx_inode_refresh();
 	reread_mapping();
@@ -64,22 +69,34 @@ void pcap_loop_cb(u_char *useless,const struct pcap_pkthdr* header,const u_char*
 		if(0 == (st_packet_num % 10))
 			mypcap_flush(st_hdl_out_mypcap);
 	}
-	
-	struct sniff_ethernet *eth_header = (struct sniff_ethernet *)packet;
-	uint16_t vlan_shift = 0;
-	if( eth_header->ether_type == 0x0081 ) {
-		vlan_shift = 4;
-		packet = packet + vlan_shift;
+	if (header->caplen < ETHER_HEADER_SIZE) {
+		return;
 	}
-		
-	sniff_ip_t *ip_header = (sniff_ip_t*)(packet+ETHER_HEADER_SIZE);
+	const size_t packet_len = header->caplen;
+	size_t ip_offset = ETHER_HEADER_SIZE;
+	const struct sniff_ethernet *eth_header = (const struct sniff_ethernet *)packet;
+	if (ntohs(eth_header->ether_type) == 0x8100 || ntohs(eth_header->ether_type) == 0x88a8) {
+		if (packet_len < ETHER_HEADER_SIZE + 4) {
+			return;
+		}
+		ip_offset += 4;
+	}
+	if (packet_len < ip_offset + IP4_HEADER_SIZE) {
+		return;
+	}
+	const sniff_ip_t *ip_header = (const sniff_ip_t *)(packet + ip_offset);
+	size_t ip_header_len = IP_HL(ip_header) * 4U;
+	if (IP_V(ip_header) != 4 || ip_header_len < IP4_HEADER_SIZE ||
+		ip_header->ip_p != IPPROTO_UDP || packet_len < ip_offset + ip_header_len + UDP_HEADER_SIZE) {
+		return;
+	}
+	const sniff_udp_t *udp_header = (const sniff_udp_t *)(packet + ip_offset + ip_header_len);
+
 	char str_ip_src[STR_IP4_SIZE+1]="";
 	char str_ip_dst[STR_IP4_SIZE+1]="";
 	strncpy(str_ip_src,inet_ntoa(ip_header->ip_src),STR_IP4_SIZE);
 	strncpy(str_ip_dst,inet_ntoa(ip_header->ip_dst),STR_IP4_SIZE);
 	
-	sniff_udp_t *udp_header = (sniff_udp_t*)(packet+ETHER_HEADER_SIZE+IP4_HEADER_SIZE);
-	
 	char hashkey[HASHKEYSIZE];
 	snprintf(hashkey, HASHKEYSIZE * sizeof(char), "%s:%d-%s:%d",
 			str_ip_src,
@@ -165,9 +182,17 @@ int32_t main(int argc, char **argv )
 	}
 	
 	if( argc > 1 ) {
+		if (strlen(argv[1]) >= sizeof(st_device)) {
+			fprintf(stderr, "ERROR: Interface name is too long\n");
+			return 2;
+		}
 		strcpy(st_device, argv[1]);
 	}
 	if( argc > 2 ) {
+		if (strlen(argv[2]) >= sizeof(st_filter)) {
+			fprintf(stderr, "ERROR: Filter is too long\n");
+			return 2;
+		}
 		strcpy(st_filter, argv[2]);
 	}
 	
@@ -213,6 +238,11 @@ int32_t main(int argc, char **argv )
     char complete_dump_path[MAX_SIZE]="";
     sprintf(complete_dump_path,"%s-complete.pcap", st_file_prefix);
 	st_hdl_out_mypcap=mypcap_open(complete_dump_path, "w+");
+	if (st_hdl_out_mypcap == NULL) {
+		fprintf(stderr, "ERROR: Cannot create %s\n", complete_dump_path);
+		pcap_close(pcap);
+		return 7;
+	}
 	
 	//Inode <-> Process Init
 	cnx_inode_refresh();//Create a list of all inode handling socket

+12

mypcap.c

View

@@ -42,11 +42,23 @@ const pcap_hdr_t cst_pcap_global_hdr = {
 
 FILE *mypcap_open(const char*filename, const char *mode) {
 	FILE *temp = fopen(filename,mode);
+	if (temp == NULL) {
+		return NULL;
+	}
 	pcap_hdr_t temphdr;
 	size_t rw_bytes = fread(&temphdr,1,sizeof(pcap_hdr_t),temp);
 	uint8_t *ptr=(uint8_t*)&cst_pcap_global_hdr;
 	if( 0 == rw_bytes ) {
+		clearerr(temp);
+		if (fseek(temp, 0, SEEK_SET) != 0) {
+			fclose(temp);
+			return NULL;
+		}
 		rw_bytes = fwrite(ptr,1,sizeof(pcap_hdr_t),temp);
+		if (rw_bytes != sizeof(pcap_hdr_t)) {
+			fclose(temp);
+			return NULL;
+		}
 		mypcap_flush(temp);
 	}
 	return temp;

...	...	@@ -62,6 +62,7 @@ void inodelist_insert_head(inode_t inode) {
62	62	head->prev = link;
63	63	}
64	64
	65	+ link->prev = NULL;
65	66	link->next = head;
66	67	head = link;
67	68	}
...	...	@@ -82,6 +83,9 @@ void inodelist_insert_tail(inode_t inode) {
82	83
83	84	inodelist_t* inodelist_remove_head() {
84	85	inodelist_t *tempLink = head;
	86	+ if (tempLink == NULL) {
	87	+ return NULL;
	88	+ }
85	89
86	90	if(head->next == NULL){
87	91	last = NULL;
...	...	@@ -94,15 +98,17 @@ inodelist_t* inodelist_remove_head() {
94	98	}
95	99
96	100	inodelist_t* inodelist_remove_tail() {
97		- inodelist_t *tempLink = head;
98		-
99		- if(head->next == NULL) {
100		- head = NULL;
101		- } else {
102		- last->prev->next = NULL;
103		- }
	101	+ if (last == NULL) {
	102	+ return NULL;
	103	+ }
	104	+ inodelist_t *tempLink = last;
104	105
105		- last = last->prev;
	106	+ last = last->prev;
	107	+ if (last == NULL) {
	108	+ head = NULL;
	109	+ } else {
	110	+ last->next = NULL;
	111	+ }
106	112	return tempLink;
107	113	}
108	114
...	...	@@ -114,19 +120,22 @@ inodelist_t* inodelist_remove_at(int index) {
114	120	return NULL;
115	121	}
116	122
117		- while(current->next != NULL) {
118		- if(current->next == NULL) {
119		- return NULL;
120		- }
	123	+ while(current != NULL) {
121	124	if( cpt == index ) {
122	125	break;
123	126	}
124	127	cpt++;
125	128	current = current->next;
126	129	}
	130	+ if (current == NULL) {
	131	+ return NULL;
	132	+ }
127	133
128	134	if(current == head) {
129	135	head = head->next;
	136	+ if (head != NULL) {
	137	+ head->prev = NULL;
	138	+ }
130	139	} else {
131	140	current->prev->next = current->next;
132	141	}
...	...	@@ -143,7 +152,7 @@ inodelist_t* inodelist_remove_at(int index) {
143	152	int32_t inodelist_get_index_from_value(uint32_t inodeval) {
144	153	inodelist_t* current = head;
145	154	int32_t cpt = 0;
146		- while(current->next != NULL) {
	155	+ while(current != NULL) {
147	156	if( current->data.inode == inodeval ) {
148	157	return cpt;
149	158	}
...	...	@@ -155,7 +164,7 @@ int32_t inodelist_get_index_from_value(uint32_t inodeval) {
155	164
156	165	inodelist_t *inodelist_get_inode_from_value(uint32_t inodeval) {
157	166	inodelist_t* current = head;
158		- while(current->next != NULL) {
	167	+ while(current != NULL) {
159	168	if( current->data.inode == inodeval ) {
160	169	return current;
161	170	}
...	...	@@ -174,7 +183,7 @@ void inodelist_insert_if_not(uint32_t inodeval) {
174	183	return;
175	184	}
176	185	inodelist_t* current = head;
177		- while(current->next != NULL) {
	186	+ while(current != NULL) {
178	187	if( current->data.inode == inodeval ) {
179	188	fprintf(stderr, "inode:%d already there\n", inodeval );
180	189	return;
...	...	@@ -201,7 +210,7 @@ void inodelist_insert_if_not_with_hashkey(uint32_t inodeval, const char *hashkey
201	210	return;
202	211	}
203	212	inodelist_t* current = head;
204		- while(current->next != NULL) {
	213	+ while(current != NULL) {
205	214	if( current->data.inode == inodeval ) {
206	215	//~ fprintf(stderr, "inode:%d already there\n", inodeval );
207	216	return;
...	...	@@ -222,10 +231,10 @@ void inodelist_insert_if_not_with_hashkey(uint32_t inodeval, const char *hashkey
222	231
223	232	inodelist_t* inodelist_find_hashkey(const char *hashkey) {
224	233	inodelist_t* current = head;
225		- while(current->next != NULL) {
226		- if( 0 == memcmp( current->data.hashkey, hashkey, strlen(hashkey) ) ) {
	234	+ while(current != NULL) {
	235	+ if( 0 == strcmp(current->data.hashkey, hashkey) ) {
227	236	return current;
228		- } else if ( 0 == memcmp( current->data.hashkey2, hashkey, strlen(hashkey) ) ) {
	237	+ } else if ( 0 == strcmp(current->data.hashkey2, hashkey) ) {
229	238	return current;
230	239	}
231	240	current = current->next;
...	...	@@ -236,7 +245,7 @@ inodelist_t* inodelist_find_hashkey(const char *hashkey) {
236	245	int32_t inodelist_get_index_from_pid(pid_t pid) {
237	246	inodelist_t* current = head;
238	247	int32_t cpt = 0;
239		- while(current->next != NULL) {
	248	+ while(current != NULL) {
240	249	if( current->data.pid == pid ) {
241	250	return cpt;
242	251	}

...	...	@@ -52,6 +52,11 @@ static char errbuff[PCAP_ERRBUF_SIZE]="";
52	52	void pcap_loop_cb(u_char useless,const struct pcap_pkthdr header,const u_char*
53	53	packet)
54	54	{
	55	+ (void)useless;
	56	+ if (header == NULL \|\| packet == NULL) {
	57	+ return;
	58	+ }
	59	+
55	60	//Inode <-> Process Update
56	61	cnx_inode_refresh();
57	62	reread_mapping();
...	...	@@ -64,22 +69,34 @@ void pcap_loop_cb(u_char useless,const struct pcap_pkthdr header,const u_char*
64	69	if(0 == (st_packet_num % 10))
65	70	mypcap_flush(st_hdl_out_mypcap);
66	71	}
67		-
68		- struct sniff_ethernet eth_header = (struct sniff_ethernet )packet;
69		- uint16_t vlan_shift = 0;
70		- if( eth_header->ether_type == 0x0081 ) {
71		- vlan_shift = 4;
72		- packet = packet + vlan_shift;
	72	+ if (header->caplen < ETHER_HEADER_SIZE) {
	73	+ return;
73	74	}
74		-
75		- sniff_ip_t ip_header = (sniff_ip_t)(packet+ETHER_HEADER_SIZE);
	75	+ const size_t packet_len = header->caplen;
	76	+ size_t ip_offset = ETHER_HEADER_SIZE;
	77	+ const struct sniff_ethernet eth_header = (const struct sniff_ethernet )packet;
	78	+ if (ntohs(eth_header->ether_type) == 0x8100 \|\| ntohs(eth_header->ether_type) == 0x88a8) {
	79	+ if (packet_len < ETHER_HEADER_SIZE + 4) {
	80	+ return;
	81	+ }
	82	+ ip_offset += 4;
	83	+ }
	84	+ if (packet_len < ip_offset + IP4_HEADER_SIZE) {
	85	+ return;
	86	+ }
	87	+ const sniff_ip_t ip_header = (const sniff_ip_t )(packet + ip_offset);
	88	+ size_t ip_header_len = IP_HL(ip_header) * 4U;
	89	+ if (IP_V(ip_header) != 4 \|\| ip_header_len < IP4_HEADER_SIZE \|\|
	90	+ ip_header->ip_p != IPPROTO_UDP \|\| packet_len < ip_offset + ip_header_len + UDP_HEADER_SIZE) {
	91	+ return;
	92	+ }
	93	+ const sniff_udp_t udp_header = (const sniff_udp_t )(packet + ip_offset + ip_header_len);
	94	+
76	95	char str_ip_src[STR_IP4_SIZE+1]="";
77	96	char str_ip_dst[STR_IP4_SIZE+1]="";
78	97	strncpy(str_ip_src,inet_ntoa(ip_header->ip_src),STR_IP4_SIZE);
79	98	strncpy(str_ip_dst,inet_ntoa(ip_header->ip_dst),STR_IP4_SIZE);
80	99
81		- sniff_udp_t udp_header = (sniff_udp_t)(packet+ETHER_HEADER_SIZE+IP4_HEADER_SIZE);
82		-
83	100	char hashkey[HASHKEYSIZE];
84	101	snprintf(hashkey, HASHKEYSIZE * sizeof(char), "%s:%d-%s:%d",
85	102	str_ip_src,
...	...	@@ -165,9 +182,17 @@ int32_t main(int argc, char **argv )
165	182	}
166	183
167	184	if( argc > 1 ) {
	185	+ if (strlen(argv[1]) >= sizeof(st_device)) {
	186	+ fprintf(stderr, "ERROR: Interface name is too long\n");
	187	+ return 2;
	188	+ }
168	189	strcpy(st_device, argv[1]);
169	190	}
170	191	if( argc > 2 ) {
	192	+ if (strlen(argv[2]) >= sizeof(st_filter)) {
	193	+ fprintf(stderr, "ERROR: Filter is too long\n");
	194	+ return 2;
	195	+ }
171	196	strcpy(st_filter, argv[2]);
172	197	}
173	198
...	...	@@ -213,6 +238,11 @@ int32_t main(int argc, char **argv )
213	238	char complete_dump_path[MAX_SIZE]="";
214	239	sprintf(complete_dump_path,"%s-complete.pcap", st_file_prefix);
215	240	st_hdl_out_mypcap=mypcap_open(complete_dump_path, "w+");
	241	+ if (st_hdl_out_mypcap == NULL) {
	242	+ fprintf(stderr, "ERROR: Cannot create %s\n", complete_dump_path);
	243	+ pcap_close(pcap);
	244	+ return 7;
	245	+ }
216	246
217	247	//Inode <-> Process Init
218	248	cnx_inode_refresh();//Create a list of all inode handling socket

...	...	@@ -42,11 +42,23 @@ const pcap_hdr_t cst_pcap_global_hdr = {
42	42
43	43	FILE mypcap_open(const charfilename, const char *mode) {
44	44	FILE *temp = fopen(filename,mode);
	45	+ if (temp == NULL) {
	46	+ return NULL;
	47	+ }
45	48	pcap_hdr_t temphdr;
46	49	size_t rw_bytes = fread(&temphdr,1,sizeof(pcap_hdr_t),temp);
47	50	uint8_t ptr=(uint8_t)&cst_pcap_global_hdr;
48	51	if( 0 == rw_bytes ) {
	52	+ clearerr(temp);
	53	+ if (fseek(temp, 0, SEEK_SET) != 0) {
	54	+ fclose(temp);
	55	+ return NULL;
	56	+ }
49	57	rw_bytes = fwrite(ptr,1,sizeof(pcap_hdr_t),temp);
	58	+ if (rw_bytes != sizeof(pcap_hdr_t)) {
	59	+ fclose(temp);
	60	+ return NULL;
	61	+ }
50	62	mypcap_flush(temp);
51	63	}
52	64	return temp;