Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libnetutil's PacketParser uses improper downcasts #500

Open
dmiller-nmap opened this issue Aug 12, 2016 · 0 comments
Open

libnetutil's PacketParser uses improper downcasts #500

dmiller-nmap opened this issue Aug 12, 2016 · 0 comments
Labels

Comments

@dmiller-nmap
Copy link

UBSan complains:

PacketParser.cc:1192:30: runtime error: downcast of address 0x60400000a990 which does not point to an object of type 'ICMPHeader'
0x60400000a990: note: object is of type 'UDPHeader'
 05 00 80 30  90 76 c3 01 00 00 00 00  08 00 00 00 be be be be  50 a9 00 00 40 60 00 00  40 bc 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'UDPHeader'
PacketParser.cc:1197:24: runtime error: downcast of address 0x60400000a950 which does not point to an object of type 'ICMPHeader'
0x60400000a950: note: object is of type 'RawData'
 06 00 80 32  f0 80 c3 01 00 00 00 00  2c 01 00 00 be be be be  00 00 00 00 00 00 00 00  90 a9 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'RawData'

Due to this code:

      /* So far we've verified that the ICMP error contains an IP datagram that matches
       * what we sent. Now, let's find the upper layer ICMP header (skip extension
       * headers until we find ICMP) */
      ICMPHeader *inner_icmp=(ICMPHeader *)iperror->getNextElement();
      while(inner_icmp!=NULL){
        if(inner_icmp->protocol_id()==HEADER_TYPE_ICMPv4 || inner_icmp->protocol_id()==HEADER_TYPE_ICMPv6 ){
            break;
        }else{
            inner_icmp=(ICMPHeader *)inner_icmp->getNextElement();
        }   
      } 

I don't think protocol_id() is implemented in the base class, which I believe to be PacketElement. We'd need to be sure that the appropriate version of the function gets called for each element (extension header).

Not labeling this a bug because it hasn't caused any visible problems so far.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant