diff --git a/libnetutil/netutil.cc b/libnetutil/netutil.cc index 8ab28dc61..d5af1d284 100644 --- a/libnetutil/netutil.cc +++ b/libnetutil/netutil.cc @@ -3024,15 +3024,21 @@ icmpbad: srchost, dsthost, icmptype, icmpinfo, icmpfields, ipinfo); } - /* UNKNOWN PROTOCOL **********************************************************/ } else if (hdr.proto == IPPROTO_ICMPV6) { - const struct icmpv6_hdr *icmpv6; + if (datalen > sizeof(struct icmpv6_hdr)) { + const struct icmpv6_hdr *icmpv6; - icmpv6 = (struct icmpv6_hdr *) data; - Snprintf(protoinfo, sizeof(protoinfo), "ICMPv6 (%d) %s > %s (type=%d/code=%d) %s", - hdr.proto, srchost, dsthost, - icmpv6->icmpv6_type, icmpv6->icmpv6_code, ipinfo); + icmpv6 = (struct icmpv6_hdr *) data; + Snprintf(protoinfo, sizeof(protoinfo), "ICMPv6 (%d) %s > %s (type=%d/code=%d) %s", + hdr.proto, srchost, dsthost, + icmpv6->icmpv6_type, icmpv6->icmpv6_code, ipinfo); + } + else { + Snprintf(protoinfo, sizeof(protoinfo), "ICMPv6 (%d) %s > %s (type=?/code=?) %s", + hdr.proto, srchost, dsthost, ipinfo); + } } else { + /* UNKNOWN PROTOCOL **********************************************************/ const char *hdrstr; hdrstr = nexthdrtoa(hdr.proto, 1); diff --git a/scan_engine_raw.cc b/scan_engine_raw.cc index 11c439302..e3bfdf255 100644 --- a/scan_engine_raw.cc +++ b/scan_engine_raw.cc @@ -181,20 +181,21 @@ void UltraProbe::setIP(u8 *ippacket, u32 len, const probespec *pspec) { } if (hdr == IPPROTO_TCP) { - assert(len >= 20); + assert(len >= sizeof(struct tcp_hdr)); tcp = (struct tcp_hdr *) data; probes.IP.pd.tcp.sport = ntohs(tcp->th_sport); probes.IP.pd.tcp.seq = ntohl(tcp->th_seq); } else if (hdr == IPPROTO_UDP) { - assert(len >= 8); + assert(len >= sizeof(struct udp_hdr)); udp = (struct udp_hdr *) data; probes.IP.pd.udp.sport = ntohs(udp->uh_sport); } else if (hdr == IPPROTO_SCTP) { - assert(len >= 12); + assert(len >= sizeof(struct sctp_hdr)); sctp = (struct sctp_hdr *) data; probes.IP.pd.sctp.sport = ntohs(sctp->sh_sport); probes.IP.pd.sctp.vtag = ntohl(sctp->sh_vtag); - } else if (hdr == IPPROTO_ICMP || hdr == IPPROTO_ICMPV6) { + } else if ((ip->ip_v == 4 && hdr == IPPROTO_ICMP) || (ip->ip_v == 6 && hdr == IPPROTO_ICMPV6)) { + assert(len >= sizeof(struct ppkt)); icmp = (struct ppkt *) data; probes.IP.pd.icmp.ident = ntohs(icmp->id); }