From 006e25977cd032d38b4c5bb731381b604fca0b45 Mon Sep 17 00:00:00 2001 From: Alex Date: Fri, 21 Jul 2023 12:32:59 +0000 Subject: [PATCH] Fix Heap-buffer-overflow (read) in NflogTlv::getType --- Packet++/header/TLVData.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Packet++/header/TLVData.h b/Packet++/header/TLVData.h index 085ba95dd9..52d629c5c7 100644 --- a/Packet++/header/TLVData.h +++ b/Packet++/header/TLVData.h @@ -259,11 +259,14 @@ namespace pcpp */ TLVRecordType getFirstTLVRecord(uint8_t* tlvDataBasePtr, size_t tlvDataLen) const { - // In most cases tlvDataLen is not zero and the size is correct therefore the overhead is not significant if the checks will be done later TLVRecordType resRec(tlvDataBasePtr); // for NRVO optimization + + // resRec pointer is out-bounds of the TLV records memory + if (resRec.getRecordBasePtr() + resRec.getTotalSize() > tlvDataBasePtr + tlvDataLen) + resRec.assign(NULL); // check if there are records at all and the total size is not zero - if (tlvDataLen == 0 || resRec.getTotalSize() == 0) + if (!resRec.isNull() && (tlvDataLen == 0 || resRec.getTotalSize() == 0)) resRec.assign(NULL); return resRec;