From b534e304568585707c4a92422aeca25cf908ff02 Mon Sep 17 00:00:00 2001
From: Guy Harris <guy@alum.mit.edu>
Date: Tue, 7 Feb 2017 10:33:07 -0800
Subject: [PATCH] CVE-2017-12993/Juniper: Add more bounds checks.

This fixes a buffer over-read discovered by Kamil Frankowicz.

Add tests using the capture files supplied by the reporter(s).
---
 print-juniper.c           |  38 ++++++++++++++++++++++++++++++++++++++
 tests/TESTLIST            |   3 +++
 tests/hoobr_juniper.out   |   1 +
 tests/hoobr_juniper.pcap  | Bin 0 -> 856 bytes
 tests/hoobr_juniper2.out  |   1 +
 tests/hoobr_juniper2.pcap | Bin 0 -> 856 bytes
 tests/hoobr_juniper3.out  |   1 +
 tests/hoobr_juniper3.pcap | Bin 0 -> 856 bytes
 8 files changed, 44 insertions(+)
 create mode 100644 tests/hoobr_juniper.out
 create mode 100644 tests/hoobr_juniper.pcap
 create mode 100644 tests/hoobr_juniper2.out
 create mode 100644 tests/hoobr_juniper2.pcap
 create mode 100644 tests/hoobr_juniper3.out
 create mode 100644 tests/hoobr_juniper3.pcap

Index: tcpdump-3.9.8/print-juniper.c
===================================================================
--- tcpdump-3.9.8.orig/print-juniper.c
+++ tcpdump-3.9.8/print-juniper.c
@@ -180,6 +180,7 @@ juniper_ggsn_print(const struct pcap_pkt
         p+=l2info.header_len;
         gh = (struct juniper_ggsn_header *)p;
 
+	TCHECK(*gh);
         if (eflag)
             printf("proto %s (%u), vlan %u: ",
                    tok2str(juniper_protocol_values,"Unknown",gh->proto),
@@ -201,6 +202,10 @@ juniper_ggsn_print(const struct pcap_pkt
         }
 
         return l2info.header_len;
+
+ trunc:
+	printf("[|juniper_services]");
+	return l2info.header_len;
 }
 #endif
 
@@ -227,6 +232,7 @@ juniper_es_print(const struct pcap_pkthd
         p+=l2info.header_len;
         ih = (struct juniper_ipsec_header *)p;
 
+	TCHECK(*ih);
         switch (ih->type) {
         case JUNIPER_IPSEC_O_ESP_ENCRYPT_ESP_AUTHEN_TYPE:
         case JUNIPER_IPSEC_O_ESP_ENCRYPT_AH_AUTHEN_TYPE:
@@ -271,6 +277,10 @@ juniper_es_print(const struct pcap_pkthd
 
         ip_print(gndo, p, l2info.length);
         return l2info.header_len;
+
+ trunc:
+	printf("[|juniper_services]");
+	return l2info.header_len;
 }
 #endif
 
@@ -294,6 +304,7 @@ juniper_monitor_print(const struct pcap_
         p+=l2info.header_len;
         mh = (struct juniper_monitor_header *)p;
 
+	TCHECK(*mh);
         if (eflag)
             printf("service-id %u, iif %u, pkt-type %u: ",
                    EXTRACT_32BITS(&mh->service_id),
@@ -304,6 +315,10 @@ juniper_monitor_print(const struct pcap_
         ip_heuristic_guess(p, l2info.length);
 
         return l2info.header_len;
+
+ trunc:
+	printf("[|juniper_services]");
+	return l2info.header_len;
 }
 #endif
 
@@ -327,6 +342,7 @@ juniper_services_print(const struct pcap
         p+=l2info.header_len;
         sh = (struct juniper_services_header *)p;
 
+	TCHECK(*sh);
         if (eflag)
             printf("service-id %u flags 0x%02x service-set-id 0x%04x iif %u: ",
                    sh->svc_id,
@@ -338,6 +354,10 @@ juniper_services_print(const struct pcap
         ip_heuristic_guess(p, l2info.length);
 
         return l2info.header_len;
+
+ trunc:
+	printf("[|juniper_services]");
+	return l2info.header_len;
 }
 #endif
 
@@ -439,6 +459,7 @@ juniper_pppoe_atm_print(const struct pca
 
         p+=l2info.header_len;
 
+	TCHECK2(p[0], 2);
         extracted_ethertype = EXTRACT_16BITS(p);
         /* this DLT contains nothing but raw PPPoE frames,
          * prepended with a type field*/
@@ -451,6 +472,10 @@ juniper_pppoe_atm_print(const struct pca
             printf("unknown ethertype 0x%04x", extracted_ethertype);
         
         return l2info.header_len;
+
+ trunc:
+	printf("[|juniper_pppoe_atm]");
+	return l2info.header_len;
 }
 #endif
 
@@ -636,6 +661,7 @@ juniper_atm1_print(const struct pcap_pkt
             return l2info.header_len;
         }
 
+	TCHECK2(p[0], 3);
         if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
             EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
 
@@ -654,6 +680,10 @@ juniper_atm1_print(const struct pcap_pkt
             return l2info.header_len;
 
 	return l2info.header_len;
+
+ trunc:
+	printf("[|juniper_atm1]");
+	return l2info.header_len;
 }
 #endif
 
@@ -684,6 +714,7 @@ juniper_atm2_print(const struct pcap_pkt
             return l2info.header_len;
         }
 
+        TCHECK2(p[0], 3);
         if (EXTRACT_24BITS(p) == 0xfefe03 || /* NLPID encaps ? */
             EXTRACT_24BITS(p) == 0xaaaa03) { /* SNAP encaps ? */
 
@@ -711,6 +742,11 @@ juniper_atm2_print(const struct pcap_pkt
             return l2info.header_len;
 
 	return l2info.header_len;
+
+
+ trunc:
+	printf("[|juniper_atm2]");
+	return l2info.header_len;
 }
 #endif
 
@@ -847,6 +883,7 @@ juniper_parse_header (const u_char *p, c
     l2info->caplen -= l2info->header_len;
 
     /* search through the cookie table and copy values matching for our PIC type */
+    TCHECK(p[0]);
     while (lp->s != NULL) {
         if (lp->pictype == l2info->pictype) {
 
@@ -927,6 +964,7 @@ juniper_parse_header (const u_char *p, c
     case DLT_JUNIPER_MLFR:
         switch (l2info->cookie_type) {
         case LS_COOKIE_ID:
+            TCHECK2(p[0], 2);
             l2info->bundle = l2info->cookie[1];
             l2info->proto = EXTRACT_16BITS(p);        
             l2info->header_len += 2;
@@ -950,6 +988,7 @@ juniper_parse_header (const u_char *p, c
     case DLT_JUNIPER_MFR:
         switch (l2info->cookie_type) {
         case LS_COOKIE_ID:
+            TCHECK2(p[0], 2);
             l2info->bundle = l2info->cookie[1];
             l2info->proto = EXTRACT_16BITS(p);        
             l2info->header_len += 2;
