Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64190

seladb · Nov 15, 2023 · d152bb2 · d152bb2
1 parent 34e4b62
commit d152bb2
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 2 deletions.
diff --git a/Packet++/header/SomeIpSdLayer.h b/Packet++/header/SomeIpSdLayer.h
@@ -769,6 +769,7 @@ class SomeIpSdLayer : public SomeIpLayer
 
 	static size_t getLenEntries(const uint8_t* data);
 	size_t getLenEntries() const;
+	static size_t getLenOptions(const uint8_t* data);
 	size_t getLenOptions() const;
 	void setLenEntries(uint32_t length);
 	void setLenOptions(uint32_t length);

diff --git a/Packet++/src/SomeIpSdLayer.cpp b/Packet++/src/SomeIpSdLayer.cpp
@@ -636,11 +636,25 @@ bool SomeIpSdLayer::isDataValid(const uint8_t* data, size_t dataLen)
 	if (!data ||
 		dataLen < sizeof(someipsdhdr) + sizeof(uint32_t) ||
 		dataLen < sizeof(someipsdhdr) + sizeof(uint32_t) + getLenEntries(data) + sizeof(uint32_t) ||
-		dataLen < be32toh(*((uint32_t *)(data + sizeof(someipsdhdr) + sizeof(uint32_t) + getLenEntries(data)))))
+		dataLen < sizeof(someipsdhdr) + sizeof(uint32_t) + getLenEntries(data) + sizeof(uint32_t) + getLenOptions(data))
 	{
 		return false;
 	}
 
+	size_t offsetOption = sizeof(someipsdhdr) + sizeof(uint32_t) + getLenEntries(data) + sizeof(uint32_t);
+	size_t lenOptions = getLenOptions(data);
+	uint32_t len = 0;
+	while (len < lenOptions)
+	{
+		if (len + sizeof(uint16_t) + 3 * sizeof(uint8_t) > lenOptions)
+			return false;
+
+		uint32_t lenOption = be16toh(*((uint16_t *)(data + offsetOption + len))) + 3 * sizeof(uint8_t);
+		len += lenOption;
+		if (len > lenOptions) // the last must be equal to lenOptions
+			return false;
+	}
+
 	return true;
 }
 
@@ -791,7 +805,12 @@ size_t SomeIpSdLayer::getLenEntries(const uint8_t* data)
 
 size_t SomeIpSdLayer::getLenOptions() const
 {
-	return be32toh(*((uint32_t *)(m_Data + sizeof(someipsdhdr) + sizeof(uint32_t) + getLenEntries())));
+	return getLenOptions(m_Data);
+}
+
+size_t SomeIpSdLayer::getLenOptions(const uint8_t* data)
+{
+	return be32toh(*((uint32_t *)(data + sizeof(someipsdhdr) + sizeof(uint32_t) + getLenEntries(data))));
 }
 
 void SomeIpSdLayer::setLenEntries(uint32_t length)