Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential multiplication overflow when calculating length of NdpOptionPacket #679

Open
heikki-heikkila opened this issue Apr 9, 2024 · 0 comments

Comments

@heikki-heikkila
Copy link

heikki-heikkila commented Apr 9, 2024

In https://github.com/libpnet/libpnet/blob/main/pnet_packet/src/icmpv6.rs#L304, length calculation is as follows:

    /// Calculate a length of a `NdpOption`'s payload.
    fn ndp_option_payload_length(option: &NdpOptionPacket) -> usize {
        let len = option.get_length();
        if len > 0 {
            ((len * 8) - 2) as usize
        } else {
            0
        }
    }

Value "len" is of type u8, so multiplication "len * 8" is done with 8-bit unsigned arithmetic. If len is 32 or more, the result is overflow; this is UB. The correct calculation, of course, is "len as usize * 8".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant