Fix oss-fuzz issue 64110 (#1236)

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64110
seladb · Nov 14, 2023 · a0ecc6d · a0ecc6d
1 parent 9814366
commit a0ecc6d
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 4 deletions.
diff --git a/Packet++/header/GreLayer.h b/Packet++/header/GreLayer.h
@@ -276,6 +276,16 @@ namespace pcpp
 		 */
 		bool unsetKey();
 
+		/**
+		 * A static method that validates the input data
+		 * @param[in] data The pointer to the beginning of a byte stream of an GREv0 layer
+		 * @param[in] dataLen The length of the byte stream
+		 * @return True if the data is valid and can represent an GREv0 layer
+		 */
+		static inline bool isDataValid(const uint8_t* data, size_t dataLen)
+		{
+			return data && dataLen >= sizeof(gre_basic_header);
+		}
 
 		// implement abstract methods
 
@@ -350,6 +360,16 @@ namespace pcpp
 		 */
 		bool unsetAcknowledgmentNum();
 
+		/**
+		 * A static method that validates the input data
+		 * @param[in] data The pointer to the beginning of a byte stream of an GREv1 layer
+		 * @param[in] dataLen The length of the byte stream
+		 * @return True if the data is valid and can represent an GREv1 layer
+		 */
+		static inline bool isDataValid(const uint8_t* data, size_t dataLen)
+		{
+			return data && dataLen >= sizeof(gre1_header);
+		}
 
 		// implement abstract methods
 

diff --git a/Packet++/src/IPv4Layer.cpp b/Packet++/src/IPv4Layer.cpp
@@ -289,9 +289,9 @@ void IPv4Layer::parseNextLayer()
 		break;
 	case PACKETPP_IPPROTO_GRE:
 		greVer = GreLayer::getGREVersion(payload, payloadLen);
-		if (greVer == GREv0)
+		if (greVer == GREv0 && GREv0Layer::isDataValid(payload, payloadLen))
 			m_NextLayer = new GREv0Layer(payload, payloadLen, this, m_Packet);
-		else if (greVer == GREv1)
+		else if (greVer == GREv1 && GREv1Layer::isDataValid(payload, payloadLen))
 			m_NextLayer = new GREv1Layer(payload, payloadLen, this, m_Packet);
 		else
 			m_NextLayer = new PayloadLayer(payload, payloadLen, this, m_Packet);

diff --git a/Packet++/src/IPv6Layer.cpp b/Packet++/src/IPv6Layer.cpp
@@ -241,9 +241,9 @@ void IPv6Layer::parseNextLayer()
 	case PACKETPP_IPPROTO_GRE:
 	{
 		ProtocolType greVer = GreLayer::getGREVersion(payload, payloadLen);
-		if (greVer == GREv0)
+		if (greVer == GREv0 && GREv0Layer::isDataValid(payload, payloadLen))
 			m_NextLayer = new GREv0Layer(payload, payloadLen, this, m_Packet);
-		else if (greVer == GREv1)
+		else if (greVer == GREv1 && GREv1Layer::isDataValid(payload, payloadLen))
 			m_NextLayer = new GREv1Layer(payload, payloadLen, this, m_Packet);
 		else
 			m_NextLayer = new PayloadLayer(payload, payloadLen, this, m_Packet);