From e2740b7c0a9ffb287560b8c35087c12834243a5e Mon Sep 17 00:00:00 2001 From: aled-ua Date: Tue, 24 Dec 2024 07:59:04 +0000 Subject: [PATCH 1/2] Fix vuln OSV-2024-343 --- Packet++/src/BgpLayer.cpp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Packet++/src/BgpLayer.cpp b/Packet++/src/BgpLayer.cpp index 4e1269abcf..85c7105352 100644 --- a/Packet++/src/BgpLayer.cpp +++ b/Packet++/src/BgpLayer.cpp @@ -542,6 +542,11 @@ namespace pcpp if (headerLen >= minLen) { size_t withdrawnRouteLen = getWithdrawnRoutesLength(); + // Ensure the memory access is within bounds + if (sizeof(bgp_common_header) + sizeof(uint16_t) + withdrawnRouteLen + sizeof(uint16_t) > headerLen) + { + return 0; // Invalid access, return 0 + } uint16_t res = be16toh(*(uint16_t*)(m_Data + sizeof(bgp_common_header) + sizeof(uint16_t) + withdrawnRouteLen)); if ((size_t)res > headerLen - minLen - withdrawnRouteLen) From a1304e5608e983ed83fbf7bf655e2b389e7c253b Mon Sep 17 00:00:00 2001 From: aled-ua Date: Sat, 4 Jan 2025 20:09:55 +0800 Subject: [PATCH 2/2] Fix format err --- Packet++/src/BgpLayer.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Packet++/src/BgpLayer.cpp b/Packet++/src/BgpLayer.cpp index 85c7105352..b32ab8d010 100644 --- a/Packet++/src/BgpLayer.cpp +++ b/Packet++/src/BgpLayer.cpp @@ -545,7 +545,7 @@ namespace pcpp // Ensure the memory access is within bounds if (sizeof(bgp_common_header) + sizeof(uint16_t) + withdrawnRouteLen + sizeof(uint16_t) > headerLen) { - return 0; // Invalid access, return 0 + return 0; // Invalid access, return 0 } uint16_t res = be16toh(*(uint16_t*)(m_Data + sizeof(bgp_common_header) + sizeof(uint16_t) + withdrawnRouteLen));