Bug 497819 - tcpdump segfaults when passing invalid interface number
tcpdump segfaults when passing invalid interface number
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: tcpdump (Show other bugs)
5.3
All Linux
high Severity high
: rc
: ---
Assigned To: Miroslav Lichvar
BaseOS QE
:
Depends On:
Blocks: 499522
  Show dependency treegraph
 
Reported: 2009-04-27 08:18 EDT by Olivier Fourdan
Modified: 2013-04-12 16:12 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-11-26 02:51:21 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch (663 bytes, patch)
2009-04-27 08:18 EDT, Olivier Fourdan
no flags Details | Diff

  None (edit)
Description Olivier Fourdan 2009-04-27 08:18:19 EDT
Created attachment 341421 [details]
Proposed patch

Description of problem:

tcpdump segfaults when passed an invalid interface number as a regular user

Version-Release number of selected component (if applicable):

tcpdump-3.9.4-14

How reproducible:

100% reproducible

Steps to Reproduce:

As a normal (ie non root) user, run tcpdump -i <n> whene <n> is greater than the number of available interfaces on the system.
  
Actual results:

tcpdump segfaults

Expected results:

tcpdump: Invalid adapter index

Additional info:

The problem comes from this portion of code in tcpdump.c:

    if ((devnum = atoi(optarg)) != 0) {
            if (devnum < 0)
                    error("Invalid adapter index");
            if (pcap_findalldevs(&devpointer, ebuf) < 0)
                    error("%s", ebuf);
            else {
                    for (i = 0; i < devnum-1; i++){
                            devpointer = devpointer->next;
                            if (devpointer == NULL)
                                    error("Invalid adapter index");
                    }
            }
            device = devpointer->name;
            break;
    }

There are two problems here:

1) In the loop. the test for devpointer being null is performed after dereferencing it one line above so that if the value of devnum passed is greater than the actual number of interfaces, it'll crash

2) after the loop, there is no test for devpointer being null, so that if devnum is "1", the program does not enter the loop and devpointer is never checked.

Proposed patch attached.

The bug seems to be present upstream too (in git).
Comment 10 errata-xmlrpc 2009-11-26 02:51:21 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-1605.html

Note You need to log in before you can comment on or make changes to this bug.